CVE-2026-52466
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to incorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.
Risk Assessment
This allows unauthorized users to perform operations they are not permitted to, potentially leading to data confidentiality or integrity breaches.
Recommendation
Update VuFind to a patched version or apply a workaround by manually stopping processing after detecting lack of permissions.
Original NVD description (English source)
Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.