CVE-2026-93954
- Source
- https://cve.org/CVERecord?id=CVE-2026-93954
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93954.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-93954
- Published
- 2026-09-19T21:45:11Z
- Modified
- 2026-09-24T08:22:23Z
- Severity
-
- 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization
- Details
-
A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue. PR #2558, merged as 53abc8b, moved the OIDC secret into a dedicated setting, but did not by itself restrict GET /api/v1/settings.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-285", "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93954.json" }- References
-
- https://github.com/grimmory-tools/grimmory/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93954.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-93954
- https://vuldb.com/cve/CVE-2026-93954
- https://vuldb.com/submit/943919
- https://vuldb.com/vuln/407913
- https://github.com/grimmory-tools/grimmory/issues/2430
- https://vuldb.com/vuln/407913/cti
- https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17
- https://github.com/grimmory-tools/grimmory/pull/2647
Affected packages
Git / github.com/grimmory-tools/grimmory
Affected ranges
- Type
- GIT
- Repo
- https://github.com/grimmory-tools/grimmory
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "3.3.0" }, { "last_affected": "3.3.0" }, { "introduced": "3.3.1" }, { "last_affected": "3.3.1" }, { "introduced": "3.3.2" }, { "last_affected": "3.3.2" }, { "introduced": "3.3.3" }, { "last_affected": "3.3.3" }, { "introduced": "3.4.0" }, { "last_affected": "3.4.0" }, { "introduced": "3.4.1" }, { "last_affected": "3.4.1" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
3.*
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
v3.*
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.4.0
v3.4.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93954.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "188081714249414667102187333535455095020",
"length": 248
},
"id": "CVE-2026-93954-1dd1b0fb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "saveSetting"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"336208382475066133289867484633456816003",
"41365829656248840755187976735608379928",
"147382879044610430341728342726433838172",
"69524745389541092778593916599895643875",
"250956523176288799140267802799033678035",
"72957037633638051878726622519586576804",
"159277332962259038373819230337305650596",
"237236290568232077557772039139900423148",
"180457968412403266968871580820575060020",
"327638102212986462462613253127411016486",
"38723091438151364126203662112716903801",
"99327281077565237596237638722616676454",
"70771956055940442514103611574301114154",
"238903126193692026002511292991439891563",
"195684473951704409508435199910098250580",
"231555956337640560018995182152010878702",
"255139929340726860854940497238714522377",
"99696584944108590142116870465692648980",
"93462962690850773559063799952577930191",
"339247243719762617923998245640362203091",
"300711601678977675500312273942577174057",
"306588638952411099406294367822966981208",
"251395366070202027799766471937661800442",
"249202582981044249765944832152908063554",
"76556500147829156060421782426345474397",
"136264232653779121783890326769063058830",
"92738120461523380985125361837602253468",
"219826982428364864976721535260735555862",
"9049415267011868710637458840445109595",
"286291669991153824548096367066067053828",
"98910846400601129281228588491577562087",
"331534408072283819043959263106998216511",
"266876123468060425837349692411796422385",
"226205556155022545824726086175619679312",
"13930356082564812686641497261209747072",
"333652197313874704305069233691984767224",
"86729249360105357550977082728899404084",
"149872326295547015814450840415093637573",
"173293461433045764738928211450751841885",
"205143401831708319856548912441269424505",
"92114075067404545216439876663740088978",
"321945539358386543144912649928525527735",
"126003733485645612814243591221799262285",
"252918631493131629466358941772240744200",
"221706946219708874898279408568140528223",
"70884653159035777232845202050744207071",
"293532367585348628904380587182366884330",
"279465753748043362629592856209468276013",
"321713541218129354359134501552159635365",
"66141317601269381990930722373346404093",
"265914189137710878501435970383694224503",
"193256651345271320653915882789711502101",
"85105144633930760895147310103562796421",
"107064216111742402357169403178380858075",
"212482482017137678993385686063828964942",
"190382184412682793643566334129801046608",
"131836926299073607000850676604273177073",
"243263376936872426066240727253049197100",
"189304281280965121803968348893162653734",
"124366095656577635666805216782761989604",
"40901709608522125374407901737609453361",
"266184703796531326842035297192324158018",
"40441341997507990192095186480023439607",
"91006345527619672471004833949671159922",
"242709118015612958353883944562130046675",
"200819593335700233180127499082567313905",
"181286591184481977061934758501719844155",
"278723220769311247499919228993955892298",
"224715111592095733443532261902599176127",
"170653121223497309900093312140097435737",
"19243937041194360158428861038367376530",
"331113201223786572793190358454351614380",
"67913958500617820410901946186347173475",
"20651179879236507807464147290373526358",
"194718746540148520769966534963091212207",
"178523271164704246326456887243677450118",
"245830769106612973058803440866746633928",
"246847979328339062517738165087134841365",
"338975032917254496767129377491155212580",
"203009643533305933776626849985845858804",
"304364751512107999778585267126844116036",
"32829049020933655872984850794851562610",
"302488660153349705300335016541468653917",
"339232671415146652139856489785518189517",
"37841260507721331914560606348812993251",
"183388306268510381173096580486416178060",
"227262704784517115084462151903572483247",
"314870486803770577229333335318072590061",
"147700939216736698356495657829081937180",
"261033764337660433267403084288515898798",
"206557993401002521098725462965585416662",
"265316602099891106024119548103802070337",
"24068312239401476408245017665981352923",
"300383228833044936347369467563233942691",
"225751826730491106847785927814064134262",
"328081346322577238785494672871582437833",
"152451179862536172984655155336277447737",
"226463928213100435052757208019771926241",
"61606657192979605347144854346129821451",
"149967097950252586359171177206301737279",
"130879124585457640720703488867236553128",
"237465530034190923136148261293901193811",
"262885720192249134164973405235047879766",
"104890089065970680003641953896470634721",
"216652123161357772668784514968434437212",
"221594342311895409792689340792231839089",
"302225186056976114955327748882840254795",
"329039361082805838407276618897600188778",
"339991819557072122981866493682505832752",
"336214947890944072136654027599365935711",
"314045041489802156917334540197730754445",
"83397989580957482618907624747703856174",
"163422245301293612851533131499909292516",
"111304014077005892720682741658362924081",
"300943032359916777624097353737774269928",
"131069616700276082433629593518100572984",
"256665900386332609308637859317197876577",
"214548688038311445334944898267187306250",
"23019417524240884299715136954843590366",
"32829049020933655872984850794851562610",
"302488660153349705300335016541468653917",
"210724461037988518994546381770232098082",
"105511701335027176236589746081012876069",
"120697898135082776988151206565657083151",
"205837934119181808250698008702699621616",
"155696161930978924797794390557791469033",
"247805682558684699852102736026789629154",
"136264232653779121783890326769063058830",
"92738120461523380985125361837602253468",
"219826982428364864976721535260735555862",
"239137615714250089769240199660259094888",
"225574284112930683448932831387365000720",
"48460678264365564002732747017152548410",
"105190189377754821870220811539578628241",
"115869057082978814228017432876794371015",
"205296023498428960216432718814107126195",
"146404180447518317788332633883698749382",
"291753336733892058635761985744821159126",
"331771240488843035400356851427611537907",
"250818090424543981111138131325332457270",
"43352414597767353439965998885950315456",
"141066136651506695467983400595007146934"
],
"threshold": 0.9
},
"id": "CVE-2026-93954-23852901",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "31477323488453849738465782326553223432",
"length": 3534
},
"id": "CVE-2026-93954-426c7825",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "buildAppSettings"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "152949242786563565575586630545426435671",
"length": 186
},
"id": "CVE-2026-93954-58a65f0d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "getJsonSetting"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "97120896942614744383816184568871717102",
"length": 656
},
"id": "CVE-2026-93954-6c52f073",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "buildPublicSetting"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "132745470776610601921738565893307505277",
"length": 197
},
"id": "CVE-2026-93954-769a526a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/config/CacheConfig.java",
"function": "cacheManager"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "272209877453113871968058419859665561236",
"length": 406
},
"id": "CVE-2026-93954-850008e2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "getJsonSetting"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"331224354523610469647581656858749379374",
"314998341648951815368074522621287575063",
"140155191201200488354240138559925627556",
"192934783794584319149809814787157145614",
"85891308794279052011809055172115067310",
"195102363888678203181620827753753735395",
"284101720493393432839188780487721838261",
"208123741667757427312940980078679653047",
"85587892748043417416690667686899841264",
"64588493852436341166857080042707860672",
"148759210456112124127925205704511025547",
"328885288597362853295244172170062752226",
"232140281129931574231044574896126723521",
"56051644518496598638392247344376957263",
"148078588766898339041382425094015184340",
"230520440825963648185380525241497673247",
"23942015681120003528609242518111629497",
"98502620007999112191678755430645228774",
"327715979092502253788095035305482521906",
"181752747442958136797327347697790900278",
"131422667347038302455309826999357993309",
"171144075693142794762723635012663873014",
"94366336637577588526733690898114371590",
"2312320812794399958142642405423226083",
"304758948730593912284019440142962491436",
"176212794745100256785357852225190392214",
"274856791417629758126035426453181849865"
],
"threshold": 0.9
},
"id": "CVE-2026-93954-88a57478",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/model/dto/settings/AppSettingKey.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "176268676195794364455847634348458519504",
"length": 202
},
"id": "CVE-2026-93954-ab660319",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "getJsonListSetting"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "231896767835136453833616448813715938781",
"length": 64
},
"id": "CVE-2026-93954-abb653bb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/controller/AppSettingController.java",
"function": "getAppSettings"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "312583528449009617612539710145396992035",
"length": 947
},
"id": "CVE-2026-93954-c1ac8916",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "updateSetting"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "128448417595845667156347657831470705847",
"length": 44
},
"id": "CVE-2026-93954-cb98cfd9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "getAppSettings"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "128448417595845667156347657831470705847",
"length": 44
},
"id": "CVE-2026-93954-ccb74e2f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "getPublicSettings"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"330645517801960153084985618670651193886",
"203793375890097062010491899709126113537",
"283775085733830175661399521153381435811",
"204884529401718642462839504369342380798",
"119819320631190035360315231541368065243",
"169381608276686126802401189745501341651",
"298019885402929759576415071592885962295",
"201166182348985930434758831448522856700",
"172107486293972183109635538178480822946",
"210343781998701946078271626698860460276",
"60905114263453270032959533632765655855"
],
"threshold": 0.9
},
"id": "CVE-2026-93954-df764a1e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/controller/AppSettingController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"272851499601805193693899827436311617216",
"72003928223958155928734657809816634577",
"194840874829849486059132118162533957843",
"284479184232944571880629128278606609600",
"294308425832534871143651509407020440247",
"284317469695332738616852827524163848036",
"225741464103322220738903928504980194244",
"335442210009911658886893167026959784101",
"233020525184494268362094920017932253138",
"175344250084440880796594098905887807620",
"177188712789519718517424778323075611482",
"136170572802805197503369994867893976216",
"156490899321767661495435669664257409683",
"118506381245922881901978009295928794817",
"255409735442651956940924987377976909048",
"213841988721346610031193011507441913732",
"53394244852305136197203756565277152225"
],
"threshold": 0.9
},
"id": "CVE-2026-93954-e1f72fbe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/config/CacheConfig.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "112219242425554902332471427936175285851",
"length": 482
},
"id": "CVE-2026-93954-fe3a00eb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17",
"target": {
"file": "backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java",
"function": "getSettingsMap"
}
}
]
vanir_signatures_modified
"2026-09-24T08:22:23Z"