EUVD-2026-65351
GHSA-9xwm-q597-w98q
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the shared Solr core prerequisite; PR:N because no authentication is needed; C:L for public indexed documents only; no integrity or availability impact applies.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled.
AnalysisAI
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific, non-default deployment configuration: multiple TYPO3 sites must share a single Apache Solr core rather than each site operating its own isolated core - this is the AT:P prerequisite in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.3 (Medium) reflects a network-reachable, unauthenticated vector (AV:N, PR:N) constrained by high attack complexity (AC:H) and a specific deployment prerequisite (AT:P): the target must run multiple TYPO3 sites sharing a single Solr core, which is a non-default but operationally common pattern in managed and multi-tenant hosting environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade EXT:solr to the patched version specified in the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-025; exact fixed version numbers are not independently available in the CVE data and must be confirmed from that advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users
Cache-poisoning-based access control bypass in the Apache Solr for TYPO3 Enterprise Search extension allows anonymous vi
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to rem
Frontend detail-view document lookup in the Apache Solr for TYPO3 Enterprise Search extension bypasses both the siteHash
Same technique Nosql Injection
View allShare
External POC / Exploit Code
Leaving vuln.today