Executive brief
Apache Solr for TYPO3 is an enterprise search extension that indexes and retrieves documents within a TYPO3 website. The extension's document detail-view lookup function fails to enforce the same access restrictions (site filters and user permissions) that are applied elsewhere in the system, allowing an attacker who knows or guesses a valid document ID to retrieve restricted documents without proper authorization. This could lead to unauthorized access to confidential or restricted content that should only be visible to specific users or sites.
Technical details
The vulnerability is a Broken Access Control issue (CWE-862) in the frontend detail-view document lookup mechanism. When retrieving documents by ID, the extension bypasses the siteHash filter (which restricts documents to the current site) and frontend user access filters that are normally applied during regular search operations. An unauthenticated or low-privileged visitor can exploit this by obtaining or guessing a valid Solr document ID and directly accessing the lookup endpoint, circumventing access control checks. The vulnerability affects multiple versions: 11.2.7 and earlier, 11.5.0–11.6.5, 12.0.0–12.1.3, and 13.0.0–13.1.3. Patched versions (11.2.8, 11.6.6, 12.1.4, and 13.1.4) are available.
Affected products
- dkd Internet Service GmbH Apache Solr for TYPO3 - Enterprise Search 11.2.7 and earlier, 11.5.0 to 11.6.5, 12.0.0 to 12.1.3, 13.0.0 to 13.1.3
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Patched versions 11.2.8, 11.6.6, 12.1.4, and 13.1.4 released