--- title: "TYPO3-PSA-2021-001: Sensitive links in search results of TYPO3 extension indexed_search" url: "https://news.typo3.com/security/advisory/typo3-psa-2021-001" description: It has been discovered that the TYPO3 extension “Indexed Search” may index sensitive links under certain conditions. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - "Product Updates & Roadmap" - Public Service Announcement --- # TYPO3-PSA-2021-001: Sensitive links in search results of TYPO3 extension indexed_search - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement) TYPO3-PSA-2021-001: Sensitive links in search results of TYPO3 extension indexed\_search ======================================================================================== 20 July 2021 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that the TYPO3 extension “Indexed Search” may index sensitive links under certain conditions. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/e4eaa13e33dd086a9c06f2570cb34609.jpeg)[Torben Hansen](https://news.typo3.com/article/author/torben-hansen) - **Component Type:** TYPO3 CMS - **Subcomponent:** Indexed Search (ext:indexed\_search) - **Release Date:** July 20, 2021 - **Impact:** Information Disclosure - **Type:** Advisory ### Problem Description On TYPO3 websites where the “Indexed Search” extension is used, sensitive links may get indexed. The problem occurs when a TYPO3 page contains a plugin that handles possible sensitive actions via *HTTP GET* parameters  (e.g. confirmation action for a newsletter subscription, or similar token-based actions used for verification). This may lead to unwanted behavior, since “Indexed Search” may add the URL to the search index and website users would be able to find the link in the search result. The impact of the problem depends on the functionality of the affected actions. For non-repeatable calls (e.g. where the URL is only valid once), there may be no impact if no sensitive user data is shown by the affected plugin. For repeatable actions (e.g. link to editing form of users’ newsletter subscription), the problem may lead to information disclosure or data modification. The problem will only occur when the URL is fully cacheable (contains a valid *cHash* for all parameters). ### Solution Indexed search currently has no mechanism allowing extensions to intercept the indexing process - page contents are indexed before uncached extension plugins are processed. The recommended way to avoid sensitive links getting indexed is to exclude the whole page from the page index. ![](https://news.typo3.com/fileadmin/_processed_/e/5/csm_indexed-search_27c1cf0696.webp) If excluding the page from the index is not suitable (e.g. because it also contains content that must be indexed), we recommend to use a custom [PSR-15 Middleware](https://docs.typo3.org/m/typo3/reference-coreapi/master/en-us/ApiOverview/RequestHandling/Index.html) (TYPO3 9.5 and upwards) or a TSFE hook to conditionally set the “no\_search” property at runtime based on routing parameters. Note, that it is important to set the “no\_search” property before the indexed search pageIndexing hook is called in TSFE. ### Credits Thanks to Karsten Nowak who brought this topic to our attention. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security-guidelines). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/7cf52722a5b7183b29d378a2284bd103.jpeg) About the Author [Torben Hansen](https://news.typo3.com/article/author/torben-hansen) Open Source Enthusiast & TYPO3 Expert I’m a passionate open-source advocate and dedicated TYPO3 expert. As a freelancer, I offer professional TYPO3 services to clients while actively contributing to the TYPO3 ecosystem. I have developed several public TYPO3 extensions and serve as the Co-Lead of the TYPO3 Security Team, helping to enhance the platform’s security and functionality. For many years, I have been blogging about TYPO3, sharing insights and expertise with the community. [More posts by this author](https://news.typo3.com/article/author/torben-hansen)