Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by GitHub_M

CVE-2026-46487GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field

High 7.5

In plain English

A high-severity missing authorization in core-geonetwork from geonetwork. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 59.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.geonetwork-opensource:geonetworkno fix listedGHSA-582q-v28r-7cxr
Mavenorg.geonetwork-opensource:geonetwork4.2.16GHSA-582q-v28r-7cxr
Mavenorg.geonetwork-opensource:geonetwork4.4.11GHSA-582q-v28r-7cxr

Affected products (as reported)

VendorProductVersions
geonetwork core-geonetwork >= 4.0.0-alpha.1, <= 4.0.6-0>= 4.2.0, < 4.2.16>= 4.4.0, < 4.4.11

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References