CVE-2026-56093: Solr Extension Auth Bypass Vulnerability

CVE-2026-56093 Overview

CVE-2026-56093 is an access control flaw in a TYPO3 extension's frontend detail-view document lookup. The lookup path retrieves Solr documents by identifier without applying the current site's siteHash filter or the frontend user access filter. Both filters are enforced on the regular search path, but the detail-view code bypasses them. A visitor who obtains or guesses a valid Solr document identifier can retrieve restricted content directly. The issue is tracked as an Insecure Direct Object Reference weakness under [CWE-639].

Critical Impact
Unauthenticated network attackers can read Solr-indexed documents that should be gated by site scope or frontend user permissions, exposing content intended only for authorized visitors.

Affected Products

TYPO3 extension referenced in TYPO3 Security Advisory 2026-025

Discovery Timeline

2026-08-25 - CVE-2026-56093 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-56093

Vulnerability Analysis

The vulnerable TYPO3 extension exposes two code paths that retrieve Solr documents. The regular search path constrains queries with a siteHash filter and a frontend user access filter, ensuring results respect site boundaries and per-user access rules. The frontend detail-view lookup, which fetches a single document by identifier, omits both filters.

As a result, the detail-view endpoint returns any indexed document matching the supplied identifier regardless of the requesting site context or the visitor's frontend user group memberships. An attacker only needs a valid Solr document id, which can often be enumerated, guessed, or obtained from cached responses and referer leaks.

Exploitation requires no authentication and no user interaction. Only the confidentiality of indexed content is affected; integrity and availability of the TYPO3 installation are not impacted by this flaw.

Root Cause

The root cause is missing authorization on a secondary retrieval path. The detail-view resolver queries Solr by document identifier without composing the access-control filter query used elsewhere. This is a classic authorization-by-URL-parameter mistake mapped to [CWE-639]: Authorization Bypass Through User-Controlled Key.

Attack Vector

An unauthenticated remote attacker requests the extension's frontend detail-view endpoint with a target Solr document identifier. The extension returns the document contents even when the record belongs to another site partition or requires a frontend user group. Identifiers may be discovered through sitemaps, search result leakage, backup indexes, or brute-force enumeration.

See the TYPO3 Security Advisory 2026-025 for the fixed versions and technical description.

Detection Methods for CVE-2026-56093

Indicators of Compromise

Frontend HTTP requests to the extension's detail-view route referencing Solr document identifiers not linked from the current site.
Sequential or high-volume identifier values in query parameters, indicating enumeration.
Web server access logs showing successful 200 responses for documents that should require a frontend user session.

Detection Strategies

Correlate detail-view URL hits with the requesting session's authenticated frontend user groups and flag mismatches.
Compare the siteHash associated with a returned document against the host that served the request; log divergences.
Baseline normal detail-view traffic per site and alert on anomalous cross-site identifier access patterns.

Monitoring Recommendations

Enable verbose logging on the TYPO3 extension's detail-view controller and forward events to a centralized log platform.
Monitor Solr query logs for detail-view lookups missing the expected access filter clauses.
Track spikes in 200-OK responses on the detail-view route from single source IPs over short intervals.

How to Mitigate CVE-2026-56093

Immediate Actions Required

Apply the fixed extension version listed in TYPO3 Security Advisory 2026-025 as soon as it is available.
Inventory TYPO3 installations to identify sites running the affected extension and prioritize multi-site or access-restricted deployments.
Rotate or invalidate any Solr document identifiers that reference sensitive access-restricted content, where feasible.

Patch Information

Refer to TYPO3 Security Advisory 2026-025 for fixed versions and upgrade instructions. Apply the vendor patch through the TYPO3 Extension Manager or Composer, then clear the TYPO3 and Solr caches to ensure the corrected query logic takes effect.

Workarounds

Restrict access to the extension's frontend detail-view route at the web server or WAF layer until the patch is applied.
Remove access-restricted records from the public Solr core and index them into a separately protected core.
Disable the detail-view feature in the extension configuration if it is not required by the site.

bash

# Example: block direct detail-view access at the reverse proxy until patched
location ~* ^/index\.php {
    if ($arg_tx_solr_pi_result[document]) { return 403; }
}