CVE-2026-93955 grimmory-tools CVE debrief

Who should care

Defenders responsible for grimmory-tools grimmory deployments should assess exposure and prioritize verification of affected versions and configurations. Defenders should review and implement secure configurations for the Download Endpoint. Operators of affected product deployments should verify their environment and implement compensating controls if necessary.

Why it matters

Defenders should prioritize verifying the affected versions and configurations of grimmory-tools grimmory in their environment, and assess exposure of the Download Endpoint. The exploit is now public and may be used. Limited information is available about the vulnerability, and no fixing commit or pull request is identified.

• Verify affected versions and configurations of grimmory-tools grimmory
• Assess exposure of the Download Endpoint
• Implement secure configurations for the Download Endpoint

Technical summary

The vulnerability affects the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The vulnerability affects product deployments with specific configurations. Defenders should assess exposure and prioritize verification of affected versions and configurations. The exploit is now public and may be used. Limited information is available about the vulnerability, and no fixing commit or pull request is identified.

Defensive priority

Defenders should prioritize verifying the affected versions and configurations of grimmory-tools grimmory in their environment, and assess exposure of the Download Endpoint.

Recommended defensive actions

• Verify the affected versions and configurations of grimmory-tools grimmory in your environment
• Assess exposure of the Download Endpoint
• Review and implement secure configurations for the Download Endpoint
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue 'has already been reported elsewhere.' No fixing commit or pull request is identified there.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.