CVE-2026-84916

Name of the Vulnerable Software and Affected Versions Islandora versions 0.0.0 through 2.19.0

Description The islandora advanced search submodule fails to sufficiently verify block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This flaw allows an unauthenticated attacker to perform forceful browsing to retrieve restricted block content, provided they can identify the machine ID of a block containing sensitive information protected by visibility restrictions.

Recommendations Update Islandora to a version later than 2.19.0. As a temporary mitigation, disable the islandora advanced search submodule.