The extension registers a named siteHash filter from a request‑supplied additionalFilters parameter before the system’s own siteHash filter. Because the query builder does not overwrite already‑registered named filters, an attacker can register a filter that references another site’s documents. This permits the attacker to read public documents that belong to a different TYPO3 site. The vulnerability is an access control flaw (CWE‑943) that leads to information disclosure.

TYPO3 extension “Apache Solr for TYPO3 – Enterprise Search” exposed through a shared Solr core. All installations using this extension and a common Solr core for multiple TYPO3 sites are affected; the specific affected versions are not listed.

The CVSS score of 6.3 indicates moderate severity combined with a lack of an EPSS score and absence from CISA’s KEV catalog, suggesting no known widespread exploitation. The attack vector is a remote web request to the Solr core. The vulnerability can be exploited by any user who can craft a Solr query containing a malicious additionalFilters parameter and has network access to the shared core, enabling access to data that should be isolated to another site.