Incorrect Authorization in Grimmory Tools

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulDB

Description

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue. PR #2558, merged as 53abc8b, moved the OIDC secret into a dedicated setting, but did not by itself restrict GET /api/v1/settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93954

Affected Vendors & Products

Vendor	Product	Version / Range
grimmory	grimmory	to 3.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an incorrect authorization issue in the grimmory-tools grimmory application up to version 3.3.3/3.4.1. It affects the Settings API Endpoint, specifically the AppSettingController.getAppSettings function in backend/src/main/java/org/booklore/controller/AppSettingController.java. The flaw allows unauthorized remote manipulation of application settings due to improper access controls.

Impact Analysis

An attacker could remotely exploit this to improperly access or modify application settings without proper authorization. This could lead to unauthorized changes in system behavior, data exposure, or disruption of services if settings are altered maliciously.

Mitigation Strategies

Apply the patch 2b66ca6df8110f6b512e030b54c16b9fbe318f17 to grimmory-tools grimmory up to 3.3.3/3.4.1. Ensure the OIDC secret is moved to a dedicated setting as per PR #2558 to restrict unauthorized GET requests to /api/v1/settings.

Hi! I’m here to help you understand CVE-2026-93954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70