EUVD-2026-65353
GHSA-2cv3-mmc6-j68f
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege access needed to trigger indexer (PR:L); cache poisoning affects other users' sessions so scope changes (S:C); no availability impact observed.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
Lifecycle Timeline
3DescriptionCVE.org
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.
AnalysisAI
Cache-poisoning-based access control bypass in the Apache Solr for TYPO3 Enterprise Search extension allows anonymous visitors to read pages that should be protected by extendToSubpages-inherited frontend-group restrictions. The extension fails to isolate its forged access-restriction state during indexer sub-requests, writing empty frontend-group and subpage-inheritance flags into the shared TYPO3 rootline cache, where they persist and serve subsequent user requests without the original restrictions applied. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires low-privilege authenticated access to initiate Apache Solr indexer sub-requests on the target TYPO3 instance, confirmed by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H) confirms that exploitation is network-reachable but non-trivial: low-privilege authenticated access is required to initiate the indexer sub-request, a specific prerequisite condition (AT:P) must be present, and high attack complexity (AC:H) indicates exploitation is not straightforwardly automatable or scriptable at scale. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patched extension release identified in the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-025; exact fixed version numbers are not confirmed in the available intelligence and must be sourced from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all TYPO3 Enterprise deployments using the Apache Solr extension and identify instances where pages enforce inherited frontend group access restrictions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php i
Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbi
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, w
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers t
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. Rated medium
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 6.1), this vulnerability is
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting.
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vul
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cr
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today