{"id":"CVE-2026-112069","revision":"dd4ca7dbdbed4f3ba5e4d052afff143f","records":[{"revision":"dd4ca7dbdbed4f3ba5e4d052afff143f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-112069","aliases":[],"title":"Broken Access Control in extension \"FAL Protect\" (fal_protect)","description":"The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.","state":0,"publishedAt":"2026-10-20T09:30:57.192+00:00","modifiedAt":"2026-10-20T15:42:06.502+00:00","affected":[{"ecosystem":"https://packagist.org/","name":"causal/fal-protect","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"TYPO3\",\n                    \"product\": \"Extension \\\"FAL Protect\\\"\",\n                    \"collectionURL\": \"https://packagist.org/\",\n                    \"packageName\": \"causal/fal-protect\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.7.1\",\n                            \"lessThan\": \"1.8.2\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.3,"severity":"MEDIUM"}],"references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-028"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112069","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-112069","identifiers":["CVE-2026-112069"]},"retained":false,"historicalAffected":[]}],"coverage":[]}