CVE-2026-46723 Information Disclosure in extension "Faceted Search" (ke_search)
Backend users can copy sensitive data from internal tables into the search index via arbitrary table configuration in the Faceted Search extension.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46723?
CVE-2026-46723 is a medium-severity vulnerability in TYPO3 Extension "Faceted Search", published on 19 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
Weakness: CWE-668
Which versions are affected by CVE-2026-46723?
8 open source packages ship an affected version, including tpwd/ke_search.
| Package | Affected | Fixed in |
|---|---|---|
tpwd/ke_search Packagist | All versions | 4.6.7 |
tpwd/ke_search Packagist | All versions | 4.6.7 |
tpwd/ke_search Packagist | From 5.0.0 | 5.6.2 |
tpwd/ke_search Packagist | From 5.0.0 | 5.6.2 |
tpwd/ke_search Packagist | From 6.0.0 | 6.6.1 |
tpwd/ke_search Packagist | From 6.0.0 | 6.6.1 |
2 more packages
tpwd/ke_search Packagist | From 7.0.0 | 7.0.1 |
tpwd/ke_search Packagist | From 7.0.0 | 7.0.1 |
How do I fix CVE-2026-46723?
Upgrade tpwd/ke_search to a fixed version for your release line: 4.6.7, 5.6.2, 6.6.1 or 7.0.1.
Is CVE-2026-46723 being exploited?
There is no known exploitation of CVE-2026-46723 in the wild and no public exploit code.
Sources
Also known as GHSA-67j3-jmm3-32xc.