TYPO3-EXT-SA-2026-028: Broken Access Control in extension "FAL Protect" (fal_protect)
It has been discovered that the extension "FAL Protect" (fal_protect) is vulnerable to Broken Access Control.
- Release Date: October 20, 2026
- Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
- Component: “FAL Protect” (fal_protect)
- Composer Package Name: causal/fal-protect
- Vulnerability Type: Broken Access Control
- Affected Versions: 1.7.1 - 1.8.1
- Severity: Medium
- Suggested CVSS v4.0: AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- References: CVE-2026-112069, CWE-862
Problem Description
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
Solution
Updated version 1.8.2 is available from the TYPO3 extension manager, packagist and at
https://extensions.typo3.org/extension/download/fal_protect/1.8.2/zip
Users of the extension are advised to update the extension as soon as possible.
Credits
Thanks to Sascha Löffler for reporting the vulnerability and Xavier Perseguers for providing an updated version of the extension.
General Advice
Follow the recommendations that are given in the TYPO3 Security Guide.
