CVE-2026-56094 TYPO3 CVE debrief

Who should care

Defenders responsible for TYPO3 installations and Solr cores should assess their exposure to this vulnerability and prioritize verification and remediation efforts. This includes operators managing TYPO3 sites, platform administrators overseeing Solr core configurations, vulnerability management teams evaluating the impact of this issue, and security teams responsible for ensuring the confidentiality and integrity of data within these systems.

Why it matters

CVE-2026-56094 allows a visitor to read public documents belonging to another site in a shared Solr core serving multiple TYPO3 sites. Defenders should prioritize verifying the presence of this vulnerability and assessing the exposure of their Solr cores.

• Verify the presence of this vulnerability in TYPO3 installations to prevent unauthorized access
• Assess the exposure of Solr cores to ensure data confidentiality
• Review and update the extension to prevent exploitation

Technical summary

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled. This issue arises because the query builder does not overwrite an already-registered named filter, enabling an attacker to access documents from another site.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their TYPO3 installations and assess the exposure of their Solr cores.

Recommended defensive actions

• Verify the presence of this vulnerability in TYPO3 installations
• Assess the exposure of Solr cores
• Review and update the extension to prevent unauthorized access
• Confirm whether affected TYPO3 installations exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and CVSS score. However, the exact versions of TYPO3 affected and the specific remediation steps are not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.