CVE-2026-93955

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.

• CWE-285
• CWE-639

• https://github.com/grimmory-tools/grimmory/
• https://github.com/grimmory-tools/grimmory/issues/2431
• https://github.com/grimmory-tools/grimmory/issues/2431#issuecomment-5384402858
• https://vuldb.com/cve/CVE-2026-93955
• https://vuldb.com/submit/943921
• https://vuldb.com/vuln/407914
• https://vuldb.com/vuln/407914/cti

Published

Sep 19, 2026

Last Modified

Sep 19, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93922SiYuan through 3.8.4 renders notebook names as raw HTML in t…8.8
• CVE-2026-93923SiYuan through 3.8.4 fails to escape heading style attribute…8.8
• CVE-2026-9393A vulnerability was found in H3C Magic B0 up to 100R002. Thi…8.8
• CVE-2026-9394A vulnerability was determined in Besen BS20 EV Charging Sta…3.1
• CVE-2026-9395A vulnerability was identified in Besen BS20 EV Charging Sta…3.5
• CVE-2026-93954A security vulnerability has been detected in grimmory-tools…4.3
• CVE-2026-93956A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Aff…3.5
• CVE-2026-93957A vulnerability has been found in olivier-ls PHP-FTS up to 1…4.3
• CVE-2026-93958A vulnerability was found in D-Link R95 BE9500_1.00.16. This…9.1
• CVE-2026-93959A vulnerability was determined in SourceCodester Online Revi…7.3
• CVE-2026-9396A security flaw has been discovered in Besen BS20 EV Chargin…3.7
• CVE-2026-93960A vulnerability was identified in Pixelfed up to 0.12.11. Im…4.3