CVE WatchSep 19, 2026

CVE-2026-93954

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAp

CVSS

4.3

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 19, 2026 · Last modified: Sep 19, 2026 · CWE-285 · CWE-863

EPSS · 30d

Not enough EPSS history yet.

Technical description

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue. PR #2558, merged as 53abc8b, moved the OIDC secret into a dedicated setting, but did not by itself restrict GET /api/v1/settings.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-939554.3 MED

—

———A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.3h CVE-2026-12424.3 MED

7.5%

——2The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.12h CVE-2026-924033.7 LOW

3.4%

——1The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.12h CVE-2026-842418.1 HIG

22.8%

——7IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization.12h CVE-2026-840767.6 HIG

23.9%

——7IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.11h CVE-2026-840367.4 HIG

17.6%

——5IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.11h