EUVD-2026-83610
GHSA-h26m-rx2w-qwhg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySend GET /api/v1/settings
-
ExploitEndpoint skips per-role filtering
-
ExecutionRead admin-only settings config
-
ImpactHarvest integration/OIDC configuration metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on the grimmory/BookLore backend (PR:L) - any low-privilege user session is sufficient; no admin or elevated role needed. The affected path is the Settings API endpoint GET /api/v1/settings served by AppSettingController.getAppSettings, which prior to commit 2b66ca6 returned settings without filtering by the caller's PermissionType (ADMIN / MANAGE_METADATA_CONFIG). No user interaction, no non-default configuration, and no special protocol beyond normal HTTP API access are required. Limiting factor: exploitation is impossible for wholly unauthenticated attackers, and impact is confined to disclosure of admin-scoped settings configuration (integration flags, OIDC/metadata provider config) rather than write access or credential theft. |
| Impact | This is a low-severity, low-real-risk issue despite the 'Authentication Bypass' tag. The vendor CVSS 4.0 base score is 2.1 (LOW) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N and E:P (proof-of-concept). CWE-863 (incorrect authorization) plus the source diff confirm the true nature: GET /api/v1/settings did not filter settings by the caller's privilege, so an already-authenticated low-privilege user could read app settings intended for ADMIN / MANAGE_METADATA_CONFIG roles (OIDC session/group-sync config, Kobo/OPDS/Komga integration flags, metadata provider settings, file patterns). PR:L means this is NOT a pre-auth bypass - a valid account is required, which sharply limits impact. Confidentiality impact is genuinely low (configuration metadata, not necessarily the OIDC client secret, which PR #2558 had already moved to a dedicated setting). No EPSS or KEV signal is present; exploitation status is limited to a publicly disclosed PoC (VulDB / GitHub issue #2430) rather than observed active exploitation. Net: patch during normal maintenance, not an emergency. The main signals are internally consistent - the only conflict is the misleading 'Authentication Bypass' label versus the CWE-863 authorization classification. |
| Exploit ScenarioDerived | A logged-in low-privilege BookLore/grimmory user (e.g. a standard library reader account) sends GET /api/v1/settings and receives admin-scoped configuration entries that the API failed to filter by role, disclosing integration and OIDC configuration metadata. A public proof-of-concept exists (VulDB entry and GitHub issue #2430), but exploitation requires a valid authenticated session and yields only information disclosure of settings. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
An incorrect authorization check in Grimmory (grimmory-tools/grimmory, published as BookLore) up to versions 3.3.3 and 3.4.1 lets any authenticated low-privilege account read admin-scoped application settings through the Settings API endpoint GET /api/v1/settings, because AppSettingController.getAppSettings returned the full settings map without filtering entries by the caller's PermissionType (ADMIN / MANAGE_METADATA_CONFIG). The exposure is configuration data - integration flags, OIDC session/group-sync settings, Kobo/Komga/OPDS toggles and metadata-provider configuration - not credentials or write access; the case is assessed at low severity (CVSS 4.0 base 2.1; independent CVSS 3.1 assessment AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and no KEV exploitation is recorded. Publicly available exploit code exists (referenced GitHub issue 2430) and the issue is rated low real-world risk despite the 'Authentication Bypass' tag, since the attacker must already hold a valid account and only gains read access to settings.
RemediationAI
Primary fix: update to a build containing commit 2b66ca6df8110f6b512e030b54c16b9fbe318f17, delivered through PR #2647 (https://github.com/grimmory-tools/grimmory/pull/2647) - upstream fix available (PR/commit); a released patched version number is not independently confirmed, so verify the deployed artifact actually includes that commit rather than assuming a version bump alone resolves it. Vendor advisory data also indicates a patch is available from the vendor. Do not treat PR #2558 / commit 53abc8b as a fix: it only moved the OIDC secret into a dedicated setting and did not restrict GET /api/v1/settings. If immediate upgrade is not possible, place the Settings API behind an authenticating reverse proxy or API gateway rule that permits GET /api/v1/settings only for admin sessions (for example an nginx location that returns 403 unless an admin group claim is present); the trade-off is that any front-end flow or client relying on that endpoint for non-admin-visible settings will return empty or error, though this is the same behavior the patched code enforces. Also ensure any cached responses for the appSettings/publicSettings caches are invalidated by restarting the backend after applying the patch, since the vulnerable build cached unfiltered settings for up to 24 hours. Because exploitation requires only a valid low-privilege account, audit existing user accounts and rotate any integration secrets or OIDC configuration values that were exposed to non-admin users during the exposure window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grimmory/BookLore is a Spring Boot (Java) media-library backend; the flaw is a missing-function-level authorization control, classified CWE-863 (Incorrect Authorization). AppSettingController.getAppSettings called appSettingService.getAppSettings() with no caller identity, so the response was built from the complete AppSettingKey enum regardless of the 'adminOnly' permission metadata (PermissionType.ADMIN, PermissionType.MANAGE_METADATA_CONFIG) attached to each key. The patch (PR #2647) injects AuthenticationService into the controller and derives the user before delegating to getAppSettings(user), and re-annotates the AppSettingKey enum so sensitive keys carry the sensitivity flag (the second boolean flipped to true for OIDC_SESSION_DURATION_HOURS, OIDC_GROUP_SYNC_MODE, KOBO_SETTINGS, OPDS_SERVER_ENABLED, KOMGA_API_ENABLED, KOMGA_GROUP_UNKNOWN and the metadata provider keys), which the service uses to strip non-permitted entries. The same patch deletes backend/src/main/java/org/booklore/config/CacheConfig.java, removing the Caffeine 'publicSettings'/'appSettings' caches (24-hour expireAfterWrite, max 100 entries) so that previously cached unfiltered settings maps can no longer be served to unprivileged callers. Note that PR #2558 (merged as 53abc8b) moved the OIDC client secret into a dedicated setting but did not by itself restrict GET /api/v1/settings, so deployments carrying only that change remain exposed. The CVSS 4.0 vector supplied with the record (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/E:P) matches the assessed prerequisites: network reachable, low-privilege authenticated, no user interaction, confidentiality-only low impact.
Know when Grimmory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Remote API reachable over network (AV:N/AC:L), but a valid low-privilege account is required (PR:L); impact is read-only disclosure of admin-scoped settings, so C:L and I/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue. PR #2558, merged as 53abc8b, moved the OIDC secret into a dedicated setting, but did not by itself restrict GET /api/v1/settings.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Stored XSS in Grimmory's browser-based EPUB reader (versions prior to 2.3.1) allows a low-privileged attacker who can ad
An authenticated low-privilege user of the Grimmory (BookLore) self-hosted library service can read book files belonging
Exploit-DB