Summary
CVE-2026-52466 is a critical incorrect access control (authorization bypass) vulnerability in Open Library Foundation VuFind, the open-source library resource discovery portal. The flaw allows an unauthenticated, remote attacker to execute controller functions that should be restricted, because the application returns an access-denied response but still runs the requested function. It carries a CVSS v3.1 base score of 9.8 (Critical).
Technical details
- Root cause: In
VuFindControllerAbstractBase::validateAccessPermission, the application fails to stop processing an incoming request after it determines that controller-level access permissions do not allow access to the requested function. - Trigger conditions: An attacker sends a request to a controller action that is protected by access permissions but for which they are not authorized.
- Behavior: The requester receives a response indicating access was denied, yet the protected function is executed regardless.
- Attack vector: Network; no authentication or user interaction required (CWE-863: Incorrect Authorization).
- Impact: Bypass of intended authorization controls, resulting in high confidentiality, integrity, and availability impact.
Affected software
- Open Library Foundation VuFind 4.1
- Open Library Foundation VuFind 11.0.3
Severity
- CVSS v3.1 base score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Consult the official VuFind security advisory and upgrade to the latest fixed VuFind release once available for your branch.
- If no patch can be applied: Restrict network access to the VuFind application and any access-permission-protected controllers/actions using upstream controls (WAF, reverse proxy, or firewall rules), and review controller-level access permission configurations. Monitor for unauthorized requests to protected actions.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Content of the
generatormeta tag:VuFind - The
set-cookieresponse header:VUFIND_SESSION - Raw response body:
VuFind.path,VuFind.defaultSearchBackend,VuFind.addTranslations(

