What is the CVSS score of CVE-2026-52466?

CVE-2026-52466 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of VuFind are affected by CVE-2026-52466?

VuFind library management systems running versions 11.0.3 and 4.1 contain a critical access control bypass (CVSS 9.8) allowing unauthenticated attackers to execute protected administrative functions…

How to fix or mitigate CVE-2026-52466?

Within 24 hours, identify all VuFind instances running versions 11.0.3 and 4.1, enable detailed access logging on affected systems, and audit recent logs for suspicious requests to protected controller functions. Within 7 days, deploy web application firewall rules to restrict access to sensitive controller endpoints, enable continuous monitoring and alerting for exploitation attempts, and contact the Open Library Foundation for patch availability and estimated timeline. Within 30 days, apply the vendor patch to all affected systems immediately upon release, or execute a migration plan to alternative solutions if no patch is available within your acceptable risk window.

VuFind CVE-2026-52466

EUVD-2026-53675 CRITICAL

Incorrect Authorization (CWE-863)

2026-08-06 cve@mitre.org

GHSA-4m6p-2r8v-vvqp

Authentication Bypass

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Remote, low-complexity, unauthenticated authorization bypass gives high confidentiality and integrity impact to protected functions; availability impact is not clearly established, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 13:24 vuln.today

CVSS changed

Aug 06, 2026 - 13:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 06, 2026 - 00:16 cve.org

CRITICAL 9.8

CVE Published

Aug 06, 2026 - 00:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.

AnalysisAI

Access control bypass in Open Library Foundation VuFind versions 11.0.3 and 4.1 allows unauthenticated remote attackers to invoke controller functions that should be restricted. The AbstractBase::validateAccessPermission logic returns an 'access denied' response to the requester but fails to halt request processing, so the protected function still executes server-side. Categorized as an authentication/authorization bypass (CWE-863) with a reported CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

VuFind is a PHP-based, open-source library resource discovery portal (built on Laminas/Zend MVC) widely used by academic and public libraries to expose catalog search and administrative functions. The root cause is CWE-863 (Incorrect Authorization): the framework's controller-level permission gate in VuFind\Controller\AbstractBase::validateAccessPermission correctly evaluates that the caller lacks permission and prepares a denial response, but it does not short-circuit the request lifecycle (no early return/exception/exit). Because execution continues, the dispatched controller action runs to completion, meaning the security decision is computed but never enforced - the denial message and the actual side effect are decoupled.

RemediationAI

No vendor-released fixed version was identified in the provided data, so the exact patched release cannot be cited; consult the official VuFind security advisory at https://vufind.org/wiki/security:cve-2026-52466 for the corrected version and upgrade to it as the primary fix. As compensating controls until patched: restrict network access to the VuFind application (bind admin/management routes to trusted networks or place behind a VPN/allowlist) to counter the AV:N exposure; enforce authorization at a second layer such as a reverse proxy or web-server (nginx/Apache) location rules requiring authentication for sensitive controller paths (side effect: may break legitimate anonymous discovery features if applied too broadly); and audit which functions rely solely on validateAccessPermission so their endpoints can be blocked or additionally guarded. Because the flaw is that a denial response is returned while the action still executes, monitoring for 'access denied' responses correlated with state changes can help detect exploitation but does not prevent it.