TYPO3-EXT-SA-2026-025: Multiple Vulnerabilities in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

• Release Date: August 25, 2026
• Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
• Component: "Apache Solr for TYPO3 - Enterprise Search" (solr)
• Composer Package Name: apache-solr-for-typo3/solr
• Vulnerability Type: Broken Access Control, Insecure Deserialization, Information Disclosure
• Affected Versions: 11.6.5 and below, 12.0.0 - 12.1.3, 13.0.0 - 13.1.3
• Severity: High
• Suggested CVSS v4.0: AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
• References: CVE-2026-56092, CVE-2026-56093, CVE-2026-56094, CVE-2026-56095, CVE-2026-56096, CWE-862, CWE-639, CWE-502, CWE-943

Problem Description

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages. (CVE-2026-56092)

The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access restrictions enforced elsewhere. (CVE-2026-56093)

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled. (CVE-2026-56094)

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface. (CVE-2026-56095)

The extension passes the user-supplied search query parameter to Apache Solr witholr query syntax such as wildcards, field selectors and range queries. A remote,unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and range-based blind extraction techniques, independent of any site-specific configuration. (CVE-2026-56096)

Solution

Updated versions 11.6.6, 12.1.4 and 13.1.4 are available from the TYPO3 extension

https://extensions.typo3.org/extension/download/solr/11.6.6/zip
https://extensions.typo3.org/extension/download/solr/12.1.4/zip
https://extensions.typo3.org/extension/download/solr/13.1.4/zip

Users of the extension are advised to update the extension as soon as possible.

Credits

Thanks to Stefan Bürk for reporting CVE-2026-56092, to Seungbin Yang for reporting26-56094, to Marc Bastian Heinrichs for reporting CVE-2026-56095, to Albrecht Köhnleinand Yair Hinkis for reporting CVE-2026-56096, and to Rafael Kähm and EXT:solr team by dkd Internet Service GmbH for providing updated versions of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.