PT-2026-3768 · Apache · Rule Based Authorization Plugin+1

Monkeontheroof · Published 2026-01-20 · Updated 2026-04-02 · CVE-2026-22022

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Solr versions 5.3.0 through 9.10.0

Description Deployments of Apache Solr utilizing the Rule Based Authorization Plugin are susceptible to unauthorized access to certain Solr APIs. This occurs due to insufficient input validation within the plugin's components. The issue is present only when specific conditions are met: the use of the RuleBasedAuthorizationPlugin, a configuration specifying multiple roles, a permission list utilizing predefined rules like "config-read", "config-edit", "schema-read", "metrics-read", or "security-read", the absence of the "all" predefined permission in the permission list, and a network setup allowing unfiltered client requests to Solr. The vulnerability allows attackers to bypass access controls on administrative endpoints by exploiting a logic flaw.

Recommendations For Apache Solr versions 5.3.0 through 9.10.0, ensure that the RuleBasedAuthorizationPlugin configuration specifies the "all" predefined permission and associates it with an "admin" or other privileged role. Alternatively, upgrade to a Solr version outside of the impacted range, such as version 9.10.1.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2026-01497

BIT-SOLR-2026-22022

CVE-2026-22022

GHSA-QR3P-2XJ2-Q7HQ

Affected Products

Apache Solr

Rule Based Authorization Plugin

References · 23

• https://osv.dev/vulnerability/GHSA-qr3p-2xj2-q7hq · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22022 · Vendor Advisory
• https://lists.apache.org/thread/d59hqbgo7p62myq7mgfpz7or8n1j7wbn · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2026-22022 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22022 · Security Note
• https://ubuntu.com/security/CVE-2026-22022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01497 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22022 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22022 · Vendor Advisory
• https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0 · Note
• https://github.com/apache/solr · Note
• https://twitter.com/TheHackerWire/status/2014014231981805934 · Twitter Post
• https://twitter.com/oss_security/status/2014207773953712622 · Twitter Post
• http://openwall.com/lists/oss-security/2026/01/20/4 · Note
• https://issues.apache.org/jira/browse/SOLR-18054 · Note