CVE-2026-56093: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access restrictions enforced elsewhere.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to Solr document-lookup endpoints used by the TYPO3 extension “Apache Solr for TYPO3 - Enterprise Search” (solr) so that requests enforce the same siteHash filter and frontend user access filter as the regular search path.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the extension's frontend detail-view document lookup are exposed if Solr contains documents that should be limited by site-specific filtering or frontend user access controls. The regular search path applies those restrictions, but the affected lookup does not.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction, but must be able to obtain or guess a valid Solr document ID. Exploitation also depends on the detail-view lookup being reachable and on restricted documents being indexed in Solr.
What information could be disclosed?
The issue can disclose documents returned by the detail-view lookup that would not pass the current site's siteHash filter or frontend user access filter. The provided data indicates confidentiality impact only; it does not indicate integrity or availability impact.
How can I assess whether my site is affected?
Check whether the extension's frontend detail-view lookup is enabled or reachable, then test it with a valid Solr document ID for content that should be restricted to another site or to authenticated frontend users. If the lookup returns that document without the restrictions applied by regular search, the site is affected.