Auth bypass in TYPO3 Extension "Apache Solr For - Enterprise Search"

CVE-2026-56092

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.

Vulnerability class: Broken Access Control

Affected products

Weakness classification (CWE)

References