Rafael Kähm

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests. This forged state is persisted into the shared rootline cache, which allows anonymous visitors to bypass `extendToSubpages`-inherited access restrictions on cached pages.

The frontend detail-view document lookup fails to apply the `siteHash` filter for the current site and the frontend user access filter. This differs from the regular search path, allowing a visitor who possesses or guesses a valid Solr document id to retrieve documents without the standard access restrictions.

The extension allows a request-provided `additionalFilters` parameter to register a named `siteHash` filter before the system's own `siteHash` filter is applied. Because the query builder does not overwrite an already-registered named filter, a visitor can read public documents belonging to another site in a shared Solr core serving multiple TYPO3 sites. This issue also affects the suggest top-results path when suggest is enabled.

The indexer of the extension uses the PHP `unserialize()` function to process field values returned by content object rendering when transferring multi-value data for `SOLR CLASSIFICATION`, `SOLR MULTIVALUE`, and `SOLR RELATION` content object types. This occurs instead of using a safe data format. If user-generated content stored in the TYPO3 database reaches an indexed field, it creates a PHP Object Injection surface, which allows an attacker to inject malicious serialized objects into the application.

A remote, unauthenticated attacker can exploit the way the extension handles the search query parameter passed to Apache Solr. Because advanced Solr query syntax—including wildcards, field selectors, and range queries—is not restricted, an attacker can use boolean- and range-based blind extraction techniques to enumerate indexed field names and extract their stored values.