CVE-2026-52466

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.

• CWE-863

• https://vufind.org/wiki/security:cve-2026-52466

Published

Aug 6, 2026

Last Modified

Aug 6, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5242Improper neutralization of formula elements in a CSV file vu…8.8
• CVE-2026-5243The The Plus Addons for Elementor – Addons for Elementor, Pa…6.4
• CVE-2026-52439An issue in xiandafu beetl 3.20.2 allows a remote attacker t…9.8
• CVE-2026-5244A vulnerability has been found in Cesanta Mongoose up to 7.2…9.8
• CVE-2026-5245A vulnerability was found in Cesanta Mongoose up to 7.20. Th…8.1
• CVE-2026-5246A vulnerability was determined in Cesanta Mongoose up to 7.2…8.1
• CVE-2026-52469SQL injection vulnerability in Crocus v.1.3.44 allows a remo…9.8
• CVE-2026-5247The Schedule Post Changes With PublishPress Future plugin fo…5.5
• CVE-2026-52470SQL injection vulnerability in Crocus v.1.3.44 allows a remo…9.8
• CVE-2026-52472SQL injection vulnerability in Wgcloud 3.6.4 allows a remote…9.8
• CVE-2026-52474An issue in aiflowy <= 2.1.2 allows a remote attacker to obt…7.5
• CVE-2026-52475Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allow…6.1