Vulnerability Directory | CVE-2026-22022 | Apache Solr & Lucene

Overview

Apache Solr is an open-source search platform built on Apache Lucene, designed for scalable, high-performance search and indexing. It supports full-text search, faceted search, real-time indexing, distributed searching, and high availability. Solr is widely used in applications requiring fast and efficient search capabilities, such as e-commerce, enterprise search, and log analytics.

An Improper Authorization vulnerability (CVE-2026-22022) has been identified in the FileSystemConfigSetService component. This vulnerability allows attackers to load malicious code as a plugin.

Per the Open Web Application Security Project (OWASP): "Improper Authorization occurs when an application fails to properly enforce access control policies, allowing users to bypass permission rules and perform actions they should not be authorized to execute."

This issue affects versions below 9.8.0

‍

Details

Module Info

Product: Apache Solr
Affected packages: solr-core
Affected versions: <9.8.0
GitHub repository: https://github.com/apache/solr

Published packages: https://central.sonatype.com/artifact/org.apache.solr/solr-core

Package manager: Maven
Fixed in: NES for Solr v8.11.6

Vulnerability Info

A security vulnerability has been identified in Apache Solr's RuleBasedAuthorizationPlugin. The flaw allows unauthorized bypass of certain predefined permission rules, enabling access control issues in admin handlers. Attackers could exploit this to perform unauthorized operations that should be restricted by the authorization plugin's rule configuration.

To mitigate this risk, users should ensure the RuleBasedAuthorizationPlugin is properly configured with comprehensive permission rules and that admin handler access is appropriately restricted.

‍

Mitigation

Apache Solr versions below or equal to 8.11.4 are no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations: