CVE-2026-52466 Missing authorization in n/a
Attackers can bypass access controls to execute restricted functions in VuFind, potentially gaining unauthorized access to sensitive data or features.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-52466?
CVE-2026-52466 is a critical missing authorization vulnerability in n/a, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.
Weakness: CWE-863
Which versions are affected by CVE-2026-52466?
How do I fix CVE-2026-52466?
No fix has been published for CVE-2026-52466 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-52466 being exploited?
There is no known exploitation of CVE-2026-52466 in the wild and no public exploit code.
Sources
Also known as GHSA-4m6p-2r8v-vvqp.