Read the docs
TI-2026-40486 Aliases CVE-2026-56096GHSA-j7mc-f926-6v4q

Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

Priority LOW 28CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and range-based blind extraction techniques, independent of any site-specific configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00427 37th percentileScored 2026-11-07
Fix Fixed Extension "Apache Solr for TYPO3 - Enterprise Search" (TYPO3): 13.1.4, 12.1.4, 11.6.6 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3Extension "Apache Solr for TYPO3 - Enterprise Search"13.0.0 to before 13.1.4; 12.0.0 to before 12.1.4; 11.5.0 to before 11.6.6; before 11.2.813.1.4, 12.1.4, 11.6.6, 11.2.8Patch availableCNA
  • Extension "Apache Solr for TYPO3 - Enterprise Search" VendorTYPO3 Affected 13.0.0 to before 13.1.4; 12.0.0 to before 12.1.4; 11.5.0 to before 11.6.6; before 11.2.8 Fixed in 13.1.4, 12.1.4, 11.6.6, 11.2.8 Patch available CNA

Remediation

  • Fix · CNA Extension "Apache Solr for TYPO3 - Enterprise Search" (TYPO3) Fixed in 13.1.4, 12.1.4, 11.6.6, 11.2.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search" — typo3.org/security/advisory/typo3-ext-sa-2026-025

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-40485 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Priority LOW 36
    • TI-2026-40482 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Priority LOW 35
    • TI-2026-40484 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Priority LOW 28
    Show all 5 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56096
  2. 2026-10-03 Alias added: GHSA-j7mc-f926-6v4q

References

Advisory 1

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
  • TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
  • TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences