CVE-2026-52466
Received Received - Intake

Incorrect Access Control in VuFind

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: MITRE

Description
Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-52466

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
open_library_foundation vufind 11.0.3
open_library_foundation vufind 4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

VuFind v11.0.3 and v4.1 has an Incorrect Access Control vulnerability. The application fails to stop processing a request after determining that controller-level access permissions deny access. The requester gets an access-denied response, but the requested function still executes despite the denial.

Detection Guidance

Check VuFind logs for access denial responses despite successful function execution. Monitor for unusual API or controller activity in v11.0.3 or v4.1. Review web server access logs for requests to restricted endpoints that return 403 errors but still process actions.

Impact Analysis

This vulnerability allows unauthorized users to execute restricted functions even when access should be denied. It bypasses intended permission checks, potentially leading to unauthorized data access, modification, or other unintended actions depending on the exposed functions.

Compliance Impact

This vulnerability could lead to unauthorized data access or processing, violating principles of least privilege and data protection. It may result in non-compliance with GDPR (data protection), HIPAA (health data security), or other regulations requiring strict access controls.

Mitigation Strategies

Upgrade VuFind to a patched version beyond v11.0.3 and v4.1. If upgrading is not possible, review and modify access control logic in AbstractBase.php to ensure proper request termination after permission denial. Apply network-level restrictions to block unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52466. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart