# CVE-2026-56096: TYPO3 Apache Solr for TYPO3 information disclosure in search query

Source: https://junglewise.ai/threats/cve-2026-56096-typo3-apache-solr-for-typo3-information-disclosure-in-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56096 · Severity: info · CVSS 7.5 · Published 2026-08-25

The Apache Solr for TYPO3 extension, used to provide search functionality on TYPO3 websites, fails to restrict advanced Solr query syntax in user-supplied search parameters. An unauthenticated attacker can exploit this to enumerate database field names and extract sensitive indexed data through blind search techniques, bypassing any site-specific access controls.

Vendors: [Typo3](https://junglewise.ai/threats/vendors/typo3).

## Quick answers

**Is CVE-2026-56096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56096 being exploited in the wild.

**How severe is CVE-2026-56096?** Informational severity, with a CVSS score of 7.5, published 25 August 2026.

**Which products and versions are affected?** Typo3 Apache Solr for TYPO3 11.2.7 and below, 11.5.0-11.6.5, 12.0.0-12.1.3, 13.0.0-13.1.3.

**Is there a fix for CVE-2026-56096?** A patch was published on 2026-08-25: Updated versions 11.2.8, 11.6.6, 12.1.4 and 13.1.4 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56096 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-56096?** Check whether you run Typo3 Apache Solr for TYPO3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure issue (CWE-943) in the TYPO3 Apache Solr for TYPO3 extension. The root cause is insufficient input validation: the extension passes user-supplied search query parameters directly to Apache Solr without sanitizing or restricting advanced Solr query syntax (wildcards, field selectors, range queries). An unauthenticated, remote attacker can leverage boolean-based and range-based blind extraction techniques to enumerate indexed field names and extract their stored values. This attack succeeds regardless of site-specific configuration or access controls. No authentication is required, and the attack is network-accessible.

## Affected products

- TYPO3 Apache Solr for TYPO3 11.2.7 and below, 11.5.0-11.6.5, 12.0.0-12.1.3, 13.0.0-13.1.3

## Timeline

- 2026-08-25: disclosed
- 2026-08-25: patched: Updated versions 11.2.8, 11.6.6, 12.1.4 and 13.1.4 available

## References

- [https://packagist.org/](https://packagist.org/)
- [https://typo3.org/security/advisory/typo3-ext-sa-2026-025](https://typo3.org/security/advisory/typo3-ext-sa-2026-025)