CVE-2026-93955

Name of the Vulnerable Software and Affected Versions grimmory-tools grimmory versions 3.3.3 and earlier grimmory-tools grimmory versions 3.4.1 and earlier

Description An authorization bypass exists in the Download Endpoint component. A remote attacker can manipulate the bookId argument within the streamFileToResponse() function to bypass security checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.