CVE-2026-46487
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Nov 3, 2026
CISA due date
—
The record
GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability… CWE-862
- CVE-2026-121730 emailflare before commit cf31f33 contains a missing authorization vulnerability in POST… CWE-862
- CVE-2026-121729 emailflare before commit cf31f33 contains a missing authorization vulnerability in the… CWE-862
- CVE-2026-116663 Tanium addressed an improper access controls vulnerability in Enforce. CWE-862
- CVE-2026-121253 Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
- CVE-2026-121251 Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-862
- CVE-2026-121194 Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
- CVE-2026-121199 Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38… CWE-862