Medium severity · published Oct 20, 2026
CVE-2026-112069
Broken Access Control in extension "FAL Protect" (fal_protect)
6.3
CVSS
0.5%
EPSS
No
On KEV
Description
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Extension "FAL Protect" · TYPO3
1.7.1 before 1.8.2 · source: vendor