CVE-2018-11802
Incorrect Authorization in Apache Solr
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
- Record
CVE-2018-11802- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
- Record
CVE-2018-11802- Updated
- 2026-11-02
EUVDEUVD-2022-1062 No score
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
- Record
EUVD-2022-1062- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j346-h5wc-rw2m
Incorrect Authorization in Apache Solr
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 6.6.6 and 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
- Record
GHSA-j346-h5wc-rw2m- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
- Record
CVE-2018-11802- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-j346-h5wc-rw2m
Incorrect Authorization in Apache Solr
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 6.6.6 and 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
- Record
GHSA-j346-h5wc-rw2m- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11802
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
- Record
UBUNTU-CVE-2018-11802- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1778460301 No score
TuxCare security update for org.apache.lucene (1 CVE)
TuxCare rebuilt 31 org.apache.lucene packages to address 1 CVE. Fixed in 5.5.5-tuxcare.2.
- Record
CLSA-2026-1778460301- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.solr:solr-parentMaven |
7.0.0 up to 7.7.0 | 7.7.0 |
org.apache.solr:solr-parentMaven |
before 6.6.6 | 6.6.6 |
org.apache.solr:solr-coreMaven |
7.0.0 up to 7.7.0 | 7.7.0 |
org.apache.solr:solr-coreMaven |
before 6.6.6 | 6.6.6 |
org.apache.solr:solr-parentMaven |
7.0.0 up to 7.7.0, plus listed versions 7.0.17.1.07.2.07.2.17.3.0 Show 4 moreShow less7.3.17.4.07.5.07.6.0 |
7.7.0 |
org.apache.solr:solr-parentMaven |
before 6.6.6, plus listed versions 1.3.01.4.01.4.13.1.03.2.0 Show 45 moreShow less3.3.03.4.03.5.03.6.03.6.13.6.24.0.04.0.0-ALPHA4.0.0-BETA4.1.04.10.04.10.14.10.24.10.34.10.44.2.04.2.14.3.04.3.14.4.04.5.04.5.14.6.04.6.14.7.04.7.14.7.24.8.04.8.14.9.04.9.15.0.05.1.05.2.05.2.15.3.05.3.15.3.25.4.05.4.15.5.05.5.15.5.25.5.35.5.4 |
6.6.6 |
org.apache.solr:solr-coreMaven |
7.0.0 up to 7.7.0, plus listed versions 7.0.17.1.07.2.07.2.17.3.0 Show 4 moreShow less7.3.17.4.07.5.07.6.0 |
7.7.0 |
org.apache.solr:solr-coreMaven |
before 6.6.6, plus listed versions 1.3.01.4.01.4.13.1.03.2.0 Show 45 moreShow less3.3.03.4.03.5.03.6.03.6.13.6.24.0.04.0.0-ALPHA4.0.0-BETA4.1.04.10.04.10.14.10.24.10.34.10.44.2.04.2.14.3.04.3.14.4.04.5.04.5.14.6.04.6.14.7.04.7.14.7.24.8.04.8.14.9.04.9.15.0.05.1.05.2.05.2.15.3.05.3.15.3.25.4.05.4.15.5.05.5.15.5.25.5.35.5.4 |
6.6.6 |
lucene-solrUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-13.6.2+dfsg-23.6.2+dfsg-2ubuntu0.1~esm13.6.2+dfsg-2ubuntu0.1~esm23.6.2+dfsg-2ubuntu0.1~esm4 |
None known |
lucene-solrUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-73.6.2+dfsg-83.6.2+dfsg-8ubuntu0.13.6.2+dfsg-8ubuntu0.1+esm1 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lucene-solrUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-103.6.2+dfsg-113.6.2+dfsg-18~18.043.6.2+dfsg-18~18.04.1~esm2 |
None known |
lucene-solrUbuntu:20.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-203.6.2+dfsg-22 |
None known |
lucene-solrUbuntu:22.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-24 |
None known |
lucene-solrUbuntu:24.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-26 |
None known |
lucene-solrUbuntu:25.10 |
All versions, plus listed versions 3.6.2+dfsg-26 |
None known |
lucene-solrUbuntu:26.10 |
All versions, plus listed versions 3.6.2+dfsg-27 |
None known |
lucene-solrUbuntu:26.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-263.6.2+dfsg-27 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11802 is a medium vulnerability (CVSS 4.3) in Apache Solr, published April 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.02%, the 81st percentile. Fixed in org.apache.solr:solr-parent 7.7.0.
References
openwall.com/lists/oss-security/2019/04/24/1
nvd.nist.gov/vuln/detail/CVE-2018-11802
github.com/apache/lucene-solr/commit/add003f217806afb4e1604f697cdb0a5a7115895
issues.apache.org/jira/browse/SOLR-12514
ubuntu.com/security/CVE-2018-11802
cve.org/CVERecord?id=CVE-2018-11802
Left out here: 36 versions. The JSON record has them.