CVE-2026-93954

grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization

State: Published
Severity: 5.3 Medium
Published: Sep 19, 2026
Updated: Sep 22, 2026
Reserved: Sep 19, 2026

Read the record on cve.org

Description

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue. PR #2558, merged as 53abc8b, moved the OIDC secret into a dedicated setting, but did not by itself restrict GET /api/v1/settings.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-863 Incorrect Authorization
CWE-285 Improper Authorization

Affected Products

Product	Versions
grimmorygrimmory-tools	3.3.0Affected 3.3.1Affected 3.3.2Affected 3.3.3Affected 3.4.0Affected 3.4.1Affected

References

VDB-407913 | grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorizationvdb-entrytechnical-description
VDB-407913 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-93954 | CVE Analysis and Reportthird-party-advisory
Submit #943919 | grimmory-tools grimmory 3.3.3 Incorrect Access Controlthird-party-advisory
https://github.com/grimmory-tools/grimmory/issues/2430exploitissue-tracking
https://github.com/grimmory-tools/grimmory/pull/2647issue-trackingpatch
https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17patch
https://github.com/grimmory-tools/grimmory/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.