Solr for TYPO3 CVE-2026-56092

Exploitation requires low-privilege authenticated access to initiate Apache Solr indexer sub-requests on the target TYPO3 instance, confirmed by PR:L in the CVSS 4.0 vector. The target site must be actively using TYPO3's extendToSubpages feature for frontend-group-based page access control - protected pages must rely on inherited restrictions for the bypass to expose restricted content. The AT:P attack requirement indicates an additional specific prerequisite condition must be met, such as a particular cache population state or indexer execution timing. What limits exploitation: low-privilege authenticated access is required to trigger the indexer (not unauthenticated); high attack complexity (AC:H) indicates conditions are not trivially reproducible; the specific prerequisite condition (AT:P) adds another barrier; and sites that do not use extendToSubpages-based frontend access controls are not exposed to the described confidentiality or integrity impact.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H) confirms that exploitation is network-reachable but non-trivial: low-privilege authenticated access is required to initiate the indexer sub-request, a specific prerequisite condition (AT:P) must be present, and high attack complexity (AC:H) indicates exploitation is not straightforwardly automatable or scriptable at scale. However, the cache-poisoning mechanism gives this vulnerability a disproportionate blast radius per exploitation event - a single successful trigger can expose protected content to every anonymous visitor until the cache is explicitly flushed or expires. EPSS data was not included in the provided intelligence, leaving probabilistic exploitation likelihood unquantified; this is a notable gap for defenders performing quantitative triage. This CVE is not listed in CISA KEV, and no public exploit code has been identified. The combination of missing EPSS, no KEV listing, and high attack complexity suggests this is not currently subject to mass or automated exploitation, but the severity of the cache-poisoning impact means that any TYPO3 operator relying on extendToSubpages-based access controls should treat patching as a priority rather than deferring.

An attacker with low-privilege authenticated access to a TYPO3 instance triggers an Apache Solr indexer sub-request; the extension writes forged empty frontend-group and subpage-inheritance values into the shared TYPO3 rootline cache. Any anonymous visitor who subsequently requests a page protected by inherited extendToSubpages restrictions receives the cached, restriction-free response and can read content they are not authorized to access. No public proof-of-concept has been identified, and the high attack complexity and specific prerequisite condition suggest this is not a push-button exploit.