{"cve":"CVE-2018-11802","nvd":{"published":"2020-04-01T22:15:15.147","modified":"2026-06-17T01:36:37.703","status":"Analyzed","description":"In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-863"],"references":["https://www.openwall.com/lists/oss-security/2019/04/24/1","https://www.openwall.com/lists/oss-security/2019/04/24/1"],"products":["apache:solr"],"source":"nvd","synced_at":"2026-10-19T21:03:08.679916934+00:00"},"epss":{"cve":"CVE-2018-11802","score":0.0202,"percentile":0.80945,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-j346-h5wc-rw2m","url":"https://osv.dev/vulnerability/GHSA-j346-h5wc-rw2m","summary":"Incorrect Authorization in Apache Solr","modified":"2025-11-10T15:52:00.869837Z","packages":[{"ecosystem":"Maven","name":"org.apache.solr:solr-parent","purl":"pkg:maven/org.apache.solr/solr-parent","ranges":[">=7.0.0 <7.7.0"],"fixed":["7.7.0"]},{"ecosystem":"Maven","name":"org.apache.solr:solr-parent","purl":"pkg:maven/org.apache.solr/solr-parent","ranges":["<6.6.6"],"fixed":["6.6.6"]},{"ecosystem":"Maven","name":"org.apache.solr:solr-core","purl":"pkg:maven/org.apache.solr/solr-core","ranges":[">=7.0.0 <7.7.0"],"fixed":["7.7.0"]},{"ecosystem":"Maven","name":"org.apache.solr:solr-core","purl":"pkg:maven/org.apache.solr/solr-core","ranges":["<6.6.6"],"fixed":["6.6.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}