EUVD-2026-65353
GHSA-2cv3-mmc6-j68f
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege access needed to trigger indexer (PR:L); cache poisoning affects other users' sessions so scope changes (S:C); no availability impact observed.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
Lifecycle Timeline
3DescriptionCVE.org
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.
AnalysisAI
Cache-poisoning-based access control bypass in the Apache Solr for TYPO3 Enterprise Search extension allows anonymous visitors to read pages that should be protected by extendToSubpages-inherited frontend-group restrictions. The extension fails to isolate its forged access-restriction state during indexer sub-requests, writing empty frontend-group and subpage-inheritance flags into the shared TYPO3 rootline cache, where they persist and serve subsequent user requests without the original restrictions applied. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires low-privilege authenticated access to initiate Apache Solr indexer sub-requests on the target TYPO3 instance, confirmed by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H) confirms that exploitation is network-reachable but non-trivial: low-privilege authenticated access is required to initiate the indexer sub-request, a specific prerequisite condition (AT:P) must be present, and high attack complexity (AC:H) indicates exploitation is not straightforwardly automatable or scriptable at scale. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patched extension release identified in the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-025; exact fixed version numbers are not confirmed in the available intelligence and must be sourced from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all TYPO3 Enterprise deployments using the Apache Solr extension and identify instances where pages enforce inherited frontend group access restrictions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to rem
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors
Frontend detail-view document lookup in the Apache Solr for TYPO3 Enterprise Search extension bypasses both the siteHash
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today