CVE-2026-47225 Overview
CVE-2026-47225 is a cache isolation flaw in Typesense, a fast, typo-tolerant search engine. The vulnerability affects versions prior to 29.1 and 30.2 when server-side search result caching is combined with Scoped Search API Keys. Under specific request ordering, cached search results can be reused across requests carrying different Scoped Search API Key constraints. A request may then receive search results that should have been restricted by its embedded filter. The issue is tracked under [CWE-524: Use of Cache Containing Sensitive Information] and impacts confidentiality across scoped authorization contexts. Typesense released fixes in versions 29.1 and 30.2.
Critical Impact
Cached search results can cross authorization boundaries, leaking data restricted by embedded filters in Scoped Search API Keys.
Affected Products
- Typesense versions prior to 29.1 (29.x branch)
- Typesense versions prior to 30.2 (30.x branch)
- Deployments using server-side search result caching with Scoped Search API Keys
Discovery Timeline
- 2026-06-12 - CVE-2026-47225 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47225
Vulnerability Analysis
Typesense supports Scoped Search API Keys that embed filter clauses to restrict the documents a caller can retrieve from a collection. The server also offers an opt-in search result cache to improve latency on repeated queries. The cache key generation does not fully account for the embedded filter constraints carried by the Scoped Search API Key presented with the request.
When two requests target the same collection with overlapping query parameters but different scoped key constraints, the second request can match a cached entry produced under a different authorization context. The server returns the cached result set without re-evaluating the embedded filter for the current key. Only deployments using both features together are affected.
Root Cause
The root cause is incomplete cache partitioning. The cache lookup omits the embedded filter or scoped key identity from the cache key, allowing cross-tenant result reuse. This is a classic [CWE-524] sensitive cache exposure pattern where authorization state is not part of the cache index.
Attack Vector
An authenticated client holding a Scoped Search API Key issues search requests against a collection where another caller, using a different scoped key, has recently populated the cache. The attacker controls the ordering and parameters of their own requests, increasing the probability of hitting an entry created under a broader or different scope. Exploitation requires network access to the Typesense API and a valid scoped key.
No public proof-of-concept code is available. See the GitHub Security Advisory GHSA-97x4-gm45-jpcw for vendor-provided technical details.
Detection Methods for CVE-2026-47225
Indicators of Compromise
- Search responses returning documents that fall outside the embedded filter of the presenting Scoped Search API Key
- Identical result payloads served to requests carrying different scoped keys against the same collection
- Anomalous cache hit ratios on collections used by multiple tenants or filter scopes
Detection Strategies
- Audit Typesense access logs for sequences of search requests on shared collections using different scoped keys with overlapping query parameters
- Replay sample queries with distinct scoped keys and compare returned document IDs against the embedded filter for each key
- Inspect deployed Typesense versions and flag any instance below 29.1 or 30.2 that has search result caching enabled
Monitoring Recommendations
- Enable verbose request logging that records the API key identifier, query parameters, and result counts for each search
- Alert when result sets returned to a scoped key contain document fields that violate the key's embedded filter
- Track Typesense version inventory and cache configuration as part of standard configuration management
How to Mitigate CVE-2026-47225
Immediate Actions Required
- Upgrade Typesense to version 29.1 or 30.2 on all affected nodes
- Disable server-side search result caching on clusters that cannot be upgraded immediately
- Rotate Scoped Search API Keys after upgrading if cross-scope disclosure is suspected
- Review application logs for prior queries that may have returned out-of-scope documents
Patch Information
Typesense addressed the cache isolation flaw in versions 29.1 and 30.2. The fix ensures that Scoped Search API Key constraints are incorporated into the cache key so cached entries cannot be reused across differing authorization contexts. Refer to the Typesense GitHub Security Advisory for release notes and upgrade guidance.
Workarounds
- Disable the server-side search result cache until the upgrade is complete
- Avoid combining Scoped Search API Keys with cached search endpoints in the affected versions
- Segregate sensitive collections onto dedicated Typesense clusters where caching is turned off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
