AUC: Incorrect Auth via Settings API Endpoint in Grimmory <3.4.1 (Java)
CVE-2026-93954 Published on September 19, 2026
grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization
A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue. PR #2558, merged as 53abc8b, moved the OIDC secret into a dedicated setting, but did not by itself restrict GET /api/v1/settings.
Timeline
Advisory disclosed
VulDB entry created
VulDB entry last update
Weakness Types
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-93954 has been classified to as an AuthZ vulnerability or weakness.
What is an AuthZ Vulnerability?
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-93954 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-93954
Want to know whenever a new CVE is published for Grimmory Tools Grimmory? stack.watch will email you.
Affected Versions
grimmory-tools grimmory:- Version 3.3.0 is affected.
- Version 3.3.1 is affected.
- Version 3.3.2 is affected.
- Version 3.3.3 is affected.
- Version 3.4.0 is affected.
- Version 3.4.1 is affected.