CVE-2026-56094: CWE-943 Improper Neutralization of Special Elements in Data Query Logic in TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search"

The vulnerability arises because the extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied. The query builder does not overwrite an already-registered named filter, enabling a visitor on a shared Solr core serving multiple TYPO3 sites to read public documents from other sites. The same root cause affects the suggest top-results path when suggest functionality is enabled.

An attacker can bypass site-specific filtering in a shared Solr core environment, potentially accessing public documents of other TYPO3 sites. This leads to unauthorized data disclosure across sites sharing the same Solr core. The vulnerability does not require privileges or user interaction but has a high attack complexity and limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider isolating Solr cores per site to prevent cross-site data leakage and disable suggest functionality if not required.