CVE-2026-52466

9.8 criticalEPSS 0.5%

Critical (9.8). EPSS 0.5% chance of exploitation in the next 30 days.

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-08-06
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://vufind.org/wiki/security:cve-2026-52466

Check your stack JSON