CVE-2026-56094

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied. Because the query builder does not overwrite an already-registered named filter, a visitor can read public documents belonging to another site in a shared Solr core serving multiple TYPO3 sites. This issue also affects the suggest top-results path when suggest is enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.