CVE-2026-56096— Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
Quick assessment
Affected
TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search"
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
该扩展程序将用户提供的搜索查询参数传递给 Apache Solr，未对高级 Solr 查询语法（如通配符、字段选择器和范围查询）进行限制。远程未认证攻击者可以利用这些语法，通过基于布尔值和范围的盲提取技术，枚举已索引的字段名称并提取其存储的值，且该攻击不依赖于任何站点特定的配置。
Possible ATT&CK Techniques 3 AI
T1213 · Data from Information Repositories T1592.002 · Software T1005 · Data from Local SystemAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TYPO3 | Extension "Apache Solr for TYPO3 - Enterprise Search" | 13.0.0< 13.1.4 |
affected |
12.0.0< 12.1.4 |
affected | ||
< 11.6.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-56096
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
Source: CVE Program / CVE List V5
Vulnerability Description
The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and range-based blind extraction techniques, independent of any site-specific configuration.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TYPO3 | Extension "Apache Solr for TYPO3 - Enterprise Search" | 13.0.0 ~ 13.1.4 | - |
|
II. Public POCs for CVE-2026-56096
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56096
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56096 (1)
Same Patch Batch · TYPO3 · 2026-08-25 · 24 CVEs total
| CVE-2026-77136 | 9.5 CRITICAL | Server-Side Template Injection in extension "powermail" (powermail) |
| CVE-2026-77138 | 9.3 CRITICAL | Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_po |
| CVE-2026-77142 | 8.8 HIGH | Broken Access Control in extension "Industry Directory" (yellowpages2) |
| CVE-2026-77143 | 8.8 HIGH | Broken Access Control in extension "Forum" (pforum) |
| CVE-2026-77141 | 8.8 HIGH | Broken Access Control in extension "Club Directory" (clubdirectory) |
| CVE-2026-77140 | 8.7 HIGH | Broken Access Control in extension "Telephone Directory" (telephonedirectory) |
| CVE-2026-77146 | 8.3 HIGH | Broken Access Control in extension "femanager" (femanager) |
| CVE-2026-77134 | 8.3 HIGH | Broken Access Control in extension "femanager" (femanager) |
| CVE-2026-77135 | 8.2 HIGH | Information Disclosure in extension "femanager" (femanager) |
| CVE-2026-77129 | 7.7 HIGH | Server-Side Template Injection in extension "Event management and registration" (sf_event_ |
| CVE-2026-77137 | 7.7 HIGH | SQL Injection in extension "Forms Export" (frp_form_answers) |
| CVE-2026-56095 | 7.7 HIGH | Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-56092 | 7.6 HIGH | Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-77144 | 7.1 HIGH | Broken Access Control in extension "Events 2" (events2) |
| CVE-2026-77145 | 7.1 HIGH | Broken Access Control in extension "Events 2" (events2) |
| CVE-2026-56094 | 6.3 MEDIUM | Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-56093 | 6.3 MEDIUM | Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-77128 | 6.3 MEDIUM | Broken Access Control in extension "Event management and registration" (sf_event_mgt) |
| CVE-2026-77139 | 6.0 MEDIUM | Path Traversal in extension "Mask" (mask) |
| CVE-2026-77127 | 6.0 MEDIUM | Information Disclosure in extension "Modules" (modules) |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Extension "Apache Solr for TYPO3 - Enterprise Search"
-
CVE-2026-56092
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-56093
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-56094
Information Disclosure in extension "Apache Solr for TYPO3 - -
CVE-2026-56095
Insecure Deserialization in extension "Apache Solr for TYPO3
Same vendor: TYPO3
-
CVE-2026-56092
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-56093
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-56094
Information Disclosure in extension "Apache Solr for TYPO3 - -
CVE-2026-56095
Insecure Deserialization in extension "Apache Solr for TYPO3 -
CVE-2026-77127
Information Disclosure in extension "Modules" (modules)
Same weakness: CWE-943
-
CVE-2026-56094
Information Disclosure in extension "Apache Solr for TYPO3 - -
CVE-2026-77070
n8n before 1.123.69 NoSQL Injection via MongoDB Node -
CVE-2026-76363
Structured Query Language Injection through the REST API in -
CVE-2026-76349
SPL Injection through Splunk Web Form Tokens in Splunk Enter -
CVE-2026-76331
SPL Injection through the REST API in Splunk Enterprise
V. Comments for CVE-2026-56096
No comments yet