Apache Solr for TYPO3 EUVD-2026-65352

Exploitation requires that the target TYPO3 installation has the Apache Solr for TYPO3 Enterprise Search extension installed and the frontend detail-view feature enabled, which is a standard extension feature rather than a non-default configuration. The attacker must supply a valid Solr document ID, obtained by harvesting IDs from public search responses, from URL structures, or through enumeration if IDs follow predictable patterns - this is the primary limiting factor (reflected as AC:H and AT:P in the CVSS 4.0 vector). The CVSS 4.0 vector confirms PR:N, meaning no TYPO3 backend or frontend authentication is required to reach the vulnerable endpoint. Exploitation impact is bounded to confidentiality (VC:L); no write or denial-of-service capability is introduced. Sites where all Solr-indexed content is already publicly accessible are not materially affected, since the bypassed filters would not have blocked access to that content anyway.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.3) characterizes this as a network-reachable, unauthenticated bypass with limited confidentiality impact. AC:H and AT:P together indicate meaningful exploitation prerequisites: the attacker must obtain or guess a valid Solr document ID. These IDs may be harvested from search result responses, leaked via page URLs or referrer headers, or guessed through enumeration if they follow predictable patterns. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be independently quantified. The vulnerability is not listed in CISA KEV, and no POC is known, indicating no confirmed widespread exploitation. Real-world priority should be elevated for TYPO3 deployments where Solr indexes contain access-controlled content (e.g., members-only documents, multi-tenant content segregated by siteHash); sites where all indexed content is public face negligible additional exposure from this bypass.

An attacker visits a public-facing TYPO3 site running the Solr Enterprise Search extension and performs several legitimate searches, harvesting Solr document IDs from the search result responses or from URLs exposed in the page. The attacker then issues direct requests to the frontend detail-view endpoint using those harvested IDs, bypassing the siteHash filter - allowing cross-site document access in multi-site deployments - and bypassing the frontend user access filter, retrieving documents that would normally require TYPO3 frontend authentication. No public POC is known at time of analysis.