Medium severityNVD Advisory· Published May 19, 2026· Updated Jun 17, 2026

CVE-2026-46723

Description

The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
tpwd/ke_searchPackagist	>= 7.0.0, < 7.0.1	7.0.1
tpwd/ke_searchPackagist	>= 6.0.0, < 6.6.1	6.6.1
tpwd/ke_searchPackagist	>= 5.0.0, < 5.6.2	5.6.2
tpwd/ke_searchPackagist	< 4.6.7	4.6.7

Affected products

Aimeos/CMSinferred
Package: https://packagist.org/packages/typo3/cms
TYPO3/Typo3llm-fuzzy

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-67j3-jmm3-32xcghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-46723ghsaADVISORY
github.com/FriendsOfPHP/security-advisories/blob/master/tpwd/ke_search/CVE-2026-46723.yamlghsaWEB
typo3.org/security/advisory/typo3-ext-sa-2026-011nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000