The vulnerability in TYPO3 Extension "Faceted Search" (CVE-2026-46723) arises because the additional_tables configuration for page and tt_content indexers accepts arbitrary table and field names. This misconfiguration enables a backend user who has permission to edit indexer configurations to copy sensitive data from internal TYPO3 tables into the search index. The issue is classified under CWE-668 (Exposure of Resource to Wrong Sphere), indicating improper exposure of data beyond intended boundaries. The CVSS 4.0 base score is 5.9 (medium severity), with network attack vector, low attack complexity, and high impact on confidentiality. No official patch or remediation level has been published yet.

An authorized backend user with permission to modify indexer configurations can exploit this vulnerability to access and copy sensitive data from internal TYPO3 tables into the search index. This may lead to unintended exposure of sensitive information within the system. The vulnerability does not allow privilege escalation or remote unauthenticated access but can compromise confidentiality within the authorized user scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict backend user permissions to only those necessary and carefully control who can edit indexer configurations to prevent exploitation of this vulnerability.