Executive brief
Apache Solr for TYPO3 is a search and indexing extension used by TYPO3 content management systems. The extension incorrectly persists cached access restrictions during search indexing operations, allowing anonymous website visitors to view pages and content that should be restricted based on user group permissions and page inheritance settings. This can result in unauthorized disclosure of confidential or draft content.
Technical details
The vulnerability is a broken access control issue (CWE-862, CWE-639) in the Apache Solr for TYPO3 extension's indexer. During indexer sub-requests, the extension forces empty frontend-group and subpage-inheritance restrictions onto page records, and this artificially modified state is persisted into the shared rootline cache. Subsequent requests by anonymous visitors retrieve cached page metadata with these forged empty restrictions, bypassing extendToSubpages-inherited access controls. The attack requires no authentication and is exploitable via standard HTTP requests to the web server. Patches are available in versions 11.2.8, 11.6.6, 12.1.4, and 13.1.4.
Affected products
- Apache/dkd Internet Service GmbH Solr for TYPO3 11.2.7 and below, 11.5.0–11.6.5, 12.0.0–12.1.3, 13.0.0–13.1.3
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Versions 11.2.8, 11.6.6, 12.1.4, and 13.1.4 released