Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-52466 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:9.1 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CNA: CISA-ADPCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://vufind.org/wiki/security:cve-2026-52466	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-863	Incorrect Authorization	CISA-ADP

Affected Products

Product	Versions
Open Library Foundation VuFind	>= 2.4, <= 11.0.3
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 11.0.4moderate effort Mitigation: (~10)moderate effort If your VuFind installation is managed using git, you may be able to cherry-pick the fix (commit fbe428dd801e28048aefb9542eeee64faf97d794) from the upstream repository. Perform a `git fetch` on the remote pointing at `https://github.com/vufind-org/vufind` and then run: ``` git cherry-pick fbe428dd801e28048aefb9542eeee64faf97d794 ``` Mitigation: (<= 4.1)moderate effort Manually patch the affected code if Git cherry-picking is not an option. In `$VUFIND_HOME/module/VuFind/src/VuFind/Controller/AbstractBase.php`, find this block of code: ``` if (is_object($response)) { $e->setResponse($response); } ``` and change it to: ``` if (is_object($response)) { $e->setResponse($response); $e->stopPropagation(true); } ``` This fix should work for releases 4.1 and newer. In earlier releases (as far back as 2.4, where the issue was introduced), the `$e→setResponse()` line may be slightly different, but adding the `$e→stopPropagation(true)` line immediately following it should still address the issue.

Product

Versions

Open Library Foundation VuFind

>= 2.4, <= 11.0.3

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 11.0.4moderate effort
Mitigation: (~10)moderate effort
If your VuFind installation is managed using git, you may be able to cherry-pick the fix (commit fbe428dd801e28048aefb9542eeee64faf97d794) from the upstream repository. Perform a `git fetch` on the remote pointing at `https://github.com/vufind-org/vufind` and then run: ``` git cherry-pick fbe428dd801e28048aefb9542eeee64faf97d794 ```
Mitigation: (<= 4.1)moderate effort
Manually patch the affected code if Git cherry-picking is not an option. In `$VUFIND_HOME/module/VuFind/src/VuFind/Controller/AbstractBase.php`, find this block of code: ``` if (is_object($response)) { $e->setResponse($response); } ``` and change it to: ``` if (is_object($response)) { $e->setResponse($response); $e->stopPropagation(true); } ``` This fix should work for releases 4.1 and newer. In earlier releases (as far back as 2.4, where the issue was introduced), the `$e→setResponse()` line may be slightly different, but adding the `$e→stopPropagation(true)` line immediately following it should still address the issue.

Change History

2 change records found show changes

Date	Action	Recorded By
Aug 6, 2026	CVE Modified	CISA-ADP
Aug 6, 2026	New CVE Received	[email protected]