The TYPO3 Extension "Faceted Search" contains a vulnerability (CWE-668) where the additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. This flaw allows a backend user with permission to edit indexer configurations to copy sensitive data from internal TYPO3 tables into the search index, potentially exposing data to unauthorized spheres. The issue affects multiple versions of the extension and has a CVSS 4.0 score of 5.9, indicating medium severity. No patch or official remediation guidance is currently available.

A backend user with permission to edit indexer configurations can misuse the additional_tables configuration to copy sensitive internal TYPO3 table data into the search index. This could lead to unauthorized exposure of sensitive data within the TYPO3 system. The vulnerability does not allow remote exploitation without privileges and requires a user with elevated backend permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict backend user permissions to only trusted administrators who require indexer configuration access. Monitor TYPO3 vendor advisories for updates regarding patches or official mitigations.