CVE-2026-112069: Broken Access Control in extension "FAL Protect" (fal_protect)
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue is exploitable only on websites running TYPO3 14.3 that use the FAL Protect extension and have file storages configured with a non-default relative base path.
What access would an attacker need to exploit it?
No authentication or permission check is applied when affected files are served directly by the web server. An attacker would need to request files located in an affected file storage.
How can I determine whether files may have been exposed?
Review FAL Protect file-storage configurations for non-default relative base paths on TYPO3 14.3 sites. Files in those storages may have been directly accessible without the extension's intended access controls.