Apache Solr for TYPO3 CVE-2026-56096

Exploitation requires that the target TYPO3 installation has the EXT:solr extension installed and exposes a publicly accessible search endpoint that forwards user input to Apache Solr without syntax filtering. The CVSS 4.0 AT:P (Attack Requirements: Present) metric indicates a deployment-specific prerequisite - most likely that the Solr schema is configured to store and return field values rather than solely serving tokenized relevance results; if stored values are not returned, blind extraction is impeded. Exploitation is further constrained by AC:H: crafting effective blind extraction queries requires attacker familiarity with Solr's query language and iterative probing, ruling out trivial automated scanning. No authentication is required (PR:N) and no user interaction is needed (UI:N). What limits exploitation: the attacker must correctly identify field names in use and those fields must contain sensitive data for the exfiltration to be impactful; sites indexing only publicly visible content face minimal confidentiality risk even if the injection path is reachable.

The CVSS 4.0 score of 6.3 with vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:L reflects a real but constrained threat. The attack requires no authentication and no user interaction, but AC:H and AT:P indicate meaningful complexity and deployment-specific prerequisites that limit opportunistic mass exploitation. No CISA KEV listing and no public exploit code have been identified at time of analysis, reducing immediate urgency compared to actively exploited issues. The confidentiality impact is bounded by what the Solr index actually stores and exposes - ranging from innocuous public content to sensitive document metadata depending on deployment. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified; this gap should be noted by defenders relying on that signal. The absence of integrity and availability impact (VI:N/VA:N) confirms this is a data exfiltration risk, not a system compromise vector.

An attacker identifies a public TYPO3 site with an EXT:solr-powered search form and submits queries containing Solr field selector syntax (e.g., appending 'fieldname:*' patterns) to probe which field names are indexed in the schema. Using boolean and range extraction techniques adapted from blind SQL injection methodology, the attacker iterates over field values character by character, reconstructing stored content without authentication or prior schema knowledge. No public exploit code has been identified at time of analysis, but the technique is well-documented in Solr and Lucene injection research.