CVE-2026-56094: TYPO3 Solr Information Disclosure Vulnerability

CVE-2026-56094 Overview

CVE-2026-56094 affects a TYPO3 extension that integrates Apache Solr search functionality. The vulnerability allows a request-supplied additionalFilters parameter to register a named siteHash filter before the system applies its own filter. Because the query builder does not overwrite an already-registered named filter, attacker-controlled filter values persist. In shared Solr core deployments serving multiple TYPO3 sites, a visitor can read public documents belonging to other sites hosted on the same core. The same root cause affects the suggest top-results path when the suggest feature is enabled. The issue is categorized as improper neutralization of special elements in a data query language [CWE-943].

Critical Impact
Unauthenticated network attackers can bypass site-scoping filters in shared Solr cores and read public search documents belonging to unrelated TYPO3 sites.

Affected Products

TYPO3 CMS instances using the affected Solr search extension
Deployments sharing a single Solr core across multiple TYPO3 sites
Installations with the suggest top-results feature enabled

Discovery Timeline

2026-08-25 - CVE-2026-56094 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-56094

Vulnerability Analysis

The extension builds Solr queries by registering named filters, including a siteHash filter that restricts search results to documents belonging to the requesting TYPO3 site. The query builder registers filters by name and does not overwrite an existing filter with the same name. An attacker who supplies an additionalFilters parameter in the request can pre-register a siteHash filter with attacker-chosen values. When the system later attempts to apply its own site-scoping siteHash filter, the registration is skipped because the name is already taken. The resulting Solr query executes with the attacker's filter rather than the intended site restriction. Public documents indexed for other TYPO3 sites on the shared Solr core become reachable through the search interface. The suggest top-results code path shares the same filter-registration logic and exhibits identical behavior when suggest is enabled.

Root Cause

The root cause is unsafe handling of a query-language filter parameter combined with a first-write-wins registration model in the query builder. Trusted, system-supplied constraints cannot displace untrusted, user-supplied filters with the same name. This aligns with [CWE-943] improper neutralization of special elements in a data query logic component.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends an HTTP request to the TYPO3 search endpoint with a crafted additionalFilters parameter that defines a siteHash entry. The vulnerable code path accepts the attacker-supplied filter, skips overwriting it with the correct site hash, and returns documents from other tenants of the shared Solr core. Impact is limited to information disclosure of public content that is not otherwise reachable across site boundaries; no integrity or availability impact is described. See the TYPO3 Security Advisory 2026-025 for the vendor's technical description.

Detection Methods for CVE-2026-56094

Indicators of Compromise

Search request logs containing an additionalFilters parameter that references siteHash or supplies raw Solr filter syntax targeting site scoping.
Solr access logs showing queries with duplicated or attacker-controlled siteHash filter values from anonymous visitors.
Suggest endpoint requests returning results whose site identifiers do not match the requesting host.

Detection Strategies

Inspect web server and TYPO3 request logs for the string additionalFilters combined with siteHash in query parameters or POST bodies.
Correlate Solr query logs with the originating TYPO3 site to flag responses returning documents from a different siteHash than the request origin.
Baseline normal search traffic and alert on anomalous filter parameters submitted to public search and suggest endpoints.

Monitoring Recommendations

Enable verbose logging on the Solr query and suggest handlers to capture applied filter chains.
Monitor for spikes in search or suggest traffic that returns results from multiple site hashes in short time windows.
Track TYPO3 extension versions across environments and alert when a vulnerable version remains deployed after patch release.

How to Mitigate CVE-2026-56094

Immediate Actions Required

Apply the fixed release of the affected TYPO3 Solr extension as identified in the TYPO3 Security Advisory 2026-025.
Audit all TYPO3 environments that share a single Solr core across multiple sites and prioritize patching those instances first.
Review recent search and suggest request logs for evidence of additionalFilters abuse and identify potentially exposed content.

Patch Information

Refer to the TYPO3 Security Advisory 2026-025 for the fixed extension versions and upgrade instructions. The patch ensures the system-supplied siteHash filter takes precedence over any request-provided filter with the same name across both the standard search and suggest top-results paths.

Workarounds

Disable the suggest feature until the patched version is deployed to remove one of the affected code paths.
Isolate each TYPO3 site to its own dedicated Solr core so that cross-site data exposure is not possible even if the filter is bypassed.
Filter or reject requests containing an additionalFilters parameter at the web application firewall until the extension is upgraded.

bash

# Example WAF rule concept: block additionalFilters targeting siteHash
# (adapt syntax to your WAF; not a drop-in configuration)
SecRule ARGS_NAMES "@rx ^additionalFilters" \
  "id:1056094,phase:2,deny,status:400,\
   msg:'Block CVE-2026-56094 additionalFilters abuse',\
   chain"
  SecRule ARGS "@rx siteHash" "t:none,t:lowercase"