Incorrect access control in VuFind controller permission processing (CVE-2026-52466)

A vulnerability in VuFind's controller-level permission processing allows remote attackers to execute functions blocked by access control. The `\VuFind\Controller\AbstractBase::validateAccessPermission` method fails to call `stopPropagation()` after setting an access-denied response, causing the underlying function to execute despite the requester receiving a denial. Attackers can trigger execution of restricted functionality, though they cannot view the results of that processing. Affected versions: - 2.4 through 11.0.3 We recommend updating to: 11.0.4. CVSS 9.8 · our assessment: act_now Reference: https://vufind.org/wiki/security:cve-2026-52466 Details: https://vuln.today/cve/CVE-2026-52466