CVE-2026-22022 Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin

Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in those components. Only deployments that meet all of the following criteria ar...

CVE-2026-22022

CVE-2026-22022 affects Apache Solr 5.3.0 through 9.10.0 that use Solr’s RuleBasedAuthorizationPlugin with a multi-role security.json config and a permission list that includes one or more of config-read, config-edit, schema-read, metrics-read, or security-read but does not define the all permissi...