CVE-2026-56094: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to cross-site document disclosure?
The issue affects shared Solr cores that serve multiple TYPO3 sites. A visitor may be able to retrieve public documents from another site sharing that core.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied CVSS vector. Exploitation requires sending a request with an additionalFilters parameter that registers a named siteHash filter before the extension applies its own filter.
Is the suggest feature also affected?
Yes. The same underlying filter-handling issue affects the suggest top-results path when suggest is enabled.