{"id":"CVE-2026-112069","title":"Broken Access Control in extension \"FAL Protect\" (fal_protect)","summary":"The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is o…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"TYPO3","product":"causal/fal-protect","affected":["causal/fal-protect >= 1.7.1 < 1.8.2"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T09:30:57.192Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112069","references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-028"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T12:05:07.350Z","slug":"CVE-2026-112069","body":"## Overview\n\nThe extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.\n\n## Affected\n\n- `causal/fal-protect >= 1.7.1 < 1.8.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}