TYPO3 Solr Ext: Unchecked Filter Injection Enables Site Hash Bypass
CVE-2026-56094 Published on August 25, 2026

Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-56094 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE

Weakness Type

Improper Neutralization of Special Elements in Data Query Logic

The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.


Products Associated with CVE-2026-56094

Want to know whenever a new CVE is published for TYPO3? stack.watch will email you.

TYPO3
 

Affected Versions

Extension "Apache Solr for TYPO3 - Enterprise Search":