CVE-2026-56092: high-severity vulnerability in TYPO3 Extension "Apache Solr for TYPO3…
Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6epss 0.3%
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
TYPO3 · Extension "Apache Solr for TYPO3 - Enterprise Search"Related CVEs — TYPO3 Extension "Apache Solr for TYPO3…
In the same product, most dangerous first.
CVE-2026-56096MEDIUMInformation Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.4%CVE-2026-56094MEDIUMInformation Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.3%CVE-2026-56095HIGHInsecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.3%CVE-2026-56093MEDIUMBroken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.3%