CVE-2026-112069Medium· 6.3▾ SunlitThe extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is o…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
causal/fal-protect >= 1.7.1 < 1.8.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112070Medium· 5.3Broken Access Control in extension "Analytics" (analytics)
CVE-2026-113468Medium· 6.9Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
CVE-2026-112239High· 7.2Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
CVE-2026-112071Medium· 6.9Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
CVE-2026-112066High· 7.1Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
CVE-2026-112065Medium· 5.3Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)