CVE-2026-93954

Name of the Vulnerable Software and Affected Versions grimmory-tools grimmory versions 3.3.3 and earlier grimmory-tools grimmory versions 3.4.1 and earlier

Description An incorrect authorization issue exists in the Settings API Endpoint. A remote attacker can manipulate the AppSettingController.getAppSettings() function within the backend/src/main/java/org/booklore/controller/AppSettingController.java file. This flaw allows unauthorized access to settings via the GET /api/v1/settings endpoint.

Recommendations Apply patch 2b66ca6df8110f6b512e030b54c16b9fbe318f17 for versions 3.3.3 and earlier. Apply patch 2b66ca6df8110f6b512e030b54c16b9fbe318f17 for versions 3.4.1 and earlier. Restrict access to the GET /api/v1/settings endpoint as a temporary mitigation measure.