CVE-2026-56092 - Vulnerability Details - OpenCVE

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://typo3.org/security/advisory/typo3-ext-sa-2026-025

History

Tue, 25 Aug 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.
Title		Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
Weaknesses		CWE-862
References		https://typo3.org/security/advisory/typo3-ext-sa-2026-025
Metrics		cvssV4_0 `{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: TYPO3

Published: 2026-08-25T09:00:49.567Z

Updated: 2026-08-25T09:00:49.567Z

Reserved: 2026-06-18T17:29:39.231Z

Link: CVE-2026-56092

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-25T09:17:30.807

Modified: 2026-08-25T09:17:30.807

Link: CVE-2026-56092

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-862

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56092", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "state": "PUBLISHED", "assignerShortName": "TYPO3", "dateReserved": "2026-06-18T17:29:39.231Z", "datePublished": "2026-08-25T09:00:49.567Z", "dateUpdated": "2026-08-25T09:00:49.567Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-08-25T09:00:49.567Z"}, "title": "Broken Access Control in extension \"Apache Solr for TYPO3 - Enterprise Search\" (solr)", "datePublic": "2026-08-25T09:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "affected": [{"vendor": "TYPO3", "product": "Extension \"Apache Solr for TYPO3 - Enterprise Search\"", "collectionURL": "https://packagist.org/", "packageName": "apache-solr-for-typo3/solr", "repo": "https://github.com/TYPO3-Solr/ext-solr", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.1.4", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.1.4", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "11.6.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages."}]}], "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-025", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.6, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Stefan B\u00fcrk", "type": "reporter"}, {"lang": "en", "value": "Rafael K\u00e4hm", "type": "remediation developer"}, {"lang": "en", "value": "EXT:solr team by dkd Internet Service GmbH", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}}}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org/", "defaultStatus": "unaffected", "packageName": "apache-solr-for-typo3/solr", "product": "Extension \"Apache Solr for TYPO3 - Enterprise Search\"", "repo": "https://github.com/TYPO3-Solr/ext-solr", "vendor": "TYPO3", "versions": [{"lessThan": "13.1.4", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "12.1.4", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThan": "11.6.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages."}], "id": "CVE-2026-56092", "lastModified": "2026-08-25T09:17:30.807", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}]}, "published": "2026-08-25T09:17:30.807", "references": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-025"}], "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}]}