The Faceted Search extension’s page and tt_content indexers allow the additional_tables configuration to specify any table and field names. A backend user who can edit indexer settings can use this feature to copy sensitive data from internal TYPO3 tables into the search index, exposing data that should remain confidential. This flaw is a clear information‑disclosure vulnerability corresponding to CWE‑668.

All installations of the TYPO3 extension "Faceted Search" where the additional_tables option is enabled are vulnerable. The impact is only reachable by users who have backend permissions to edit indexer configurations – typically editors or administrators. Users without such rights are unaffected, but the presence of the misconfigured option can still be exploited if credentials are compromised.

With a CVSS score of 5.9 the vulnerability is classified as medium severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting a lower public exploitation likelihood at present. However, the attack vector requires legitimate backend access, which is a realistic risk in environments with permissive editing rights. If an attacker gains such access, the disclosed data could reveal business secrets, personal information, or other confidential content, potentially violating privacy regulations and compromising business operations.