CVE-2026-56092: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Anonymous visitors can exploit it, but exploitation depends on the affected page having extendToSubpages-inherited frontend access restrictions and a poisoned shared rootline cache entry.
What conditions are required for the access-control bypass?
The Solr indexer must make sub-requests that force empty frontend-group and subpage-inheritance restrictions onto page records. That forged state must then be persisted in the shared rootline cache for pages relying on inherited access restrictions.
How can administrators determine whether they may be affected?
Review whether the Apache Solr for TYPO3 - Enterprise Search extension is installed and whether protected pages use frontend-group restrictions inherited through extendToSubpages. Also investigate whether anonymous users can access content on cached pages that should be restricted by those inherited rules.