The vulnerability arises when the Apache Solr BasicAuth bootstrap tool (bin/solr auth enable) silently creates hard‑coded template users (superadmin, admin, search, index) with known default credentials. An attacker who learns these credentials gains unrestricted administrative control over the Solr cluster, enabling configuration changes, data exfiltration, and service disruption. This flaw falls under insecure default configuration weaknesses (CWE-1188) and hard‑coded passwords (CWE-798).

Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 are affected. Clusters that never used the bin/solr auth enable command during bootstrap or that have replaced the template users with strong, unique passwords are not vulnerable.

The CVSS score of 8.1 indicates high severity, and the EPSS score of 2% suggests a modest exploitation probability. Based on the description, it is inferred that the attack vector is a remote network request to the public BasicAuth configuration endpoint, which triggers the bootstrap and installs the vulnerable users. Since the vulnerability relies on publicly known default credentials, an unauthenticated attacker with network reach to the cluster can exploit it with minimal effort; it is not listed in CISA’s KEV catalog, but the ease of exploitation makes it a significant risk.