CVE-2026-93955 | grimmory-tools grimmory up to 3.3.3/3.4.1 Download Endpoint KoboController.java streamFileToResponse bookId authorization (Issue 2431)

September 19, 2026 Yanac

A vulnerability identified as problematic has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass.

This vulnerability was named CVE-2026-93955. The attack may be initiated remotely. In addition, an exploit is available.

Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.VulDB Recent EntriesRead More