Incorrect authorization in Apache Solr
Priority LOW 24CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
Why it matters now
EPSS 0.0202 81st percentileScored 2026-11-07
Fix Partial Apache Solr (Apache): 7.7org.apache.solr:solr-parent (Maven): 7.7.0, 6.6.6+1 more productRed Hat: 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Solr | before 7.7 | 7.7 | Patch available | CNA |
| — | org.apache.solr:solr-parent (Maven) | 7.0.0 to before 7.7.0 | 7.7.0 | Patch available | GHSA-j346-h5wc-rw2m |
| — | org.apache.solr:solr-parent (Maven) | before 6.6.6 | 6.6.6 | Patch available | GHSA-j346-h5wc-rw2m |
| — | org.apache.solr:solr-core (Maven) | 7.0.0 to before 7.7.0 | 7.7.0 | Patch available | GHSA-j346-h5wc-rw2m |
| — | org.apache.solr:solr-core (Maven) | before 6.6.6 | 6.6.6 | Patch available | GHSA-j346-h5wc-rw2m |
- Apache Solr VendorApache Affected before 7.7 Fixed in 7.7 Patch available CNA
- org.apache.solr:solr-parent (Maven) Vendor— Affected 7.0.0 to before 7.7.0 Fixed in 7.7.0 Patch available GHSA-j346-h5wc-rw2m
- org.apache.solr:solr-parent (Maven) Vendor— Affected before 6.6.6 Fixed in 6.6.6 Patch available GHSA-j346-h5wc-rw2m
- org.apache.solr:solr-core (Maven) Vendor— Affected 7.0.0 to before 7.7.0 Fixed in 7.7.0 Patch available GHSA-j346-h5wc-rw2m
- org.apache.solr:solr-core (Maven) Vendor— Affected before 6.6.6 Fixed in 6.6.6 Patch available GHSA-j346-h5wc-rw2m
Remediation
- Fix · CNA Apache Solr (Apache) Fixed in 7.7
- Fix · GHSA-j346-h5wc-rw2m org.apache.solr:solr-parent (Maven) Fixed in 7.7.0 Advisory →
- Fix · GHSA-j346-h5wc-rw2m org.apache.solr:solr-parent (Maven) Fixed in 6.6.6 Advisory →
- Fix · GHSA-j346-h5wc-rw2m org.apache.solr:solr-core (Maven) Fixed in 7.7.0 Advisory →
- Fix · GHSA-j346-h5wc-rw2m org.apache.solr:solr-core (Maven) Fixed in 6.6.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| JBoss Developer Studio 11 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
Not affected: 2 products
- Red Hat Fuse 7
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-11802
- 2026-10-03 Alias added: GHSA-j346-h5wc-rw2m
References
More Apache Solr vulnerabilities
- TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
- TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
- TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
- TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-11802 · CVE Program
- CVE-2018-11802 · NVD
- FIRST EPSS
- GHSA-j346-h5wc-rw2m · GitHub Advisory Database · CC BY 4.0
- CVE-2018-11802 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences