CVE-2026-56092: Page Indexer Auth Bypass Vulnerability

CVE-2026-56092 Overview

CVE-2026-56092 affects a TYPO3 extension that mishandles access restrictions during indexer sub-requests. The extension forces empty frontend-group and subpage-inheritance restrictions onto page records while indexing. This forged state is then persisted into the shared rootline cache. Anonymous visitors can subsequently retrieve cached pages that should have been restricted through extendToSubpages-inherited access controls. The flaw maps to CWE-862 (Missing Authorization).

Critical Impact
Anonymous users can bypass frontend group and subpage access restrictions on cached TYPO3 pages, disclosing content intended for authenticated groups only.

Affected Products

TYPO3 CMS third-party extension covered under TYPO3 Security Advisory 2026-025
Installations using the vulnerable extension with extendToSubpages access restrictions
TYPO3 sites relying on the shared rootline cache for authorization decisions

Discovery Timeline

2026-08-25 - CVE-2026-56092 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-56092

Vulnerability Analysis

The vulnerability resides in the indexer sub-request handling of the affected TYPO3 extension. During indexing, the extension overrides page-record fields that control access, specifically the frontend user group restriction and the extendToSubpages inheritance flag. The extension sets both to permissive values so the indexer can traverse restricted content.

TYPO3 caches the rootline, an ordered array of parent pages used to evaluate inherited access rules. The indexer writes the modified page records into this shared cache. Subsequent frontend requests read the poisoned cache and evaluate access against the forged, permissive values rather than the true restrictions.

The result is an authorization gap. Pages that should require frontend group membership become reachable by anonymous visitors. Because rootline data is inherited downward, restricted subpages are also exposed.

Root Cause

The root cause is the reuse of a shared cache across trust boundaries. The indexer requires elevated read access to build its search index, but it writes its transient authorization state into the same rootline cache consumed by anonymous frontend requests. Access checks trust cached values without re-verifying the original restriction fields.

Attack Vector

An attacker with low privileges triggers or waits for an indexer sub-request that populates the rootline cache with the forged state. The attacker then issues anonymous HTTP requests to pages protected by extendToSubpages-inherited restrictions. The frontend serves the cached content because the cached rootline reports no access restriction. No authentication is required for the retrieval step.

See the TYPO3 Security Advisory 2026-025 for the vendor's technical description.

Detection Methods for CVE-2026-56092

Indicators of Compromise

Anonymous HTTP 200 responses returning content from pages configured with fe_group restrictions or extendToSubpages set on parent pages.
Rootline cache entries where restricted page UIDs show empty fe_group values immediately after indexer runs.
Web server access logs showing unauthenticated requests to URLs previously returning HTTP 403 or redirect responses.

Detection Strategies

Compare rendered frontend responses for restricted pages against the configured fe_group and extendToSubpages values in the TYPO3 backend.
Inspect the rootline cache table or cache backend for restricted page records that carry cleared access fields.
Correlate indexer execution timestamps with the appearance of anomalous anonymous access to protected content.

Monitoring Recommendations

Enable TYPO3 access logging and forward events to a centralized log platform for anomaly analysis.
Alert on spikes of anonymous requests to page trees that require frontend group membership.
Track indexer job execution and flush the rootline cache after each run until the extension is patched.

How to Mitigate CVE-2026-56092

Immediate Actions Required

Update the affected TYPO3 extension to the fixed version referenced in TYPO3 Security Advisory 2026-025.
Flush the TYPO3 rootline cache and any page caches after upgrading to remove poisoned entries.
Audit access logs for anonymous retrieval of restricted content since the extension was installed.

Patch Information

Apply the extension update published under TYPO3 Security Advisory 2026-025. The vendor advisory lists the affected versions and the fixed release. Verify the deployed extension version through composer show or the TYPO3 Extension Manager after upgrading.

Workarounds

Disable the vulnerable indexer functionality until the patched release is installed.
Restrict indexer sub-requests to a dedicated cache scope that is not shared with frontend rootline evaluation.
Serve restricted page trees from an origin that requires authentication at the reverse proxy layer as a defense-in-depth control.

bash

# Configuration example: clear TYPO3 caches after upgrade
vendor/bin/typo3 cache:flush
vendor/bin/typo3 cache:warmup