Typo3 Extension "Apache Solr For Typo3 Enterprise Search" vulnerabilities
5 vulnerabilities
Known vulnerabilities in Typo3 Extension "Apache Solr For Typo3 Enterprise Search", newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-56092typo3 · extension "apache solr for typo3 - enterprise search"Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.CVSS7.6HighEPSS0.29%RoutineCVE-2026-56093typo3 · extension "apache solr for typo3 - enterprise search"Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access restrictions enforced elsewhere.CVSS6.3MediumEPSS0.31%RoutineCVE-2026-56094typo3 · extension "apache solr for typo3 - enterprise search"Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled.CVSS6.3MediumEPSS0.33%RoutineCVE-2026-56095typo3 · extension "apache solr for typo3 - enterprise search"Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.CVSS7.7HighEPSS0.32%RoutineCVE-2026-56096typo3 · extension "apache solr for typo3 - enterprise search"Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and range-based blind extraction techniques, independent of any site-specific configuration.CVSS6.3MediumEPSS0.43%