{"id":"CVE-2026-93954","summary":"grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization","details":"A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue. PR #2558, merged as 53abc8b, moved the OIDC secret into a dedicated setting, but did not by itself restrict GET /api/v1/settings.","modified":"2026-09-23T08:13:04.510731Z","published":"2026-09-19T21:45:11.207Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93954.json","cna_assigner":"VulDB","cwe_ids":["CWE-285","CWE-863"]},"references":[{"type":"WEB","url":"https://github.com/grimmory-tools/grimmory/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93954.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93954"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-93954"},{"type":"ADVISORY","url":"https://vuldb.com/submit/943919"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/407913"},{"type":"REPORT","url":"https://github.com/grimmory-tools/grimmory/issues/2430"},{"type":"REPORT","url":"https://vuldb.com/vuln/407913/cti"},{"type":"FIX","url":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17"},{"type":"FIX","url":"https://github.com/grimmory-tools/grimmory/pull/2647"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/grimmory-tools/grimmory","events":[{"introduced":"1d707ffb0f3599b3dcbda44a62bd4b40c61c2fde"},{"fixed":"2b66ca6df8110f6b512e030b54c16b9fbe318f17"}],"database_specific":{"extracted_events":[{"introduced":"3.3.0"},{"last_affected":"3.3.0"},{"introduced":"3.3.1"},{"last_affected":"3.3.1"},{"introduced":"3.3.2"},{"last_affected":"3.3.2"},{"introduced":"3.3.3"},{"last_affected":"3.3.3"},{"introduced":"3.4.0"},{"last_affected":"3.4.0"},{"introduced":"3.4.1"},{"last_affected":"3.4.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","v3.4.1","v3.4.0","v3.3.3","v3.3.2","v3.3.1","v3.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93954.json","vanir_signatures_modified":"2026-09-23T08:13:04Z","vanir_signatures":[{"source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"saveSetting"},"deprecated":false,"digest":{"function_hash":"188081714249414667102187333535455095020","length":248},"id":"CVE-2026-93954-1dd1b0fb","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java"},"deprecated":false,"digest":{"line_hashes":["336208382475066133289867484633456816003","41365829656248840755187976735608379928","147382879044610430341728342726433838172","69524745389541092778593916599895643875","250956523176288799140267802799033678035","72957037633638051878726622519586576804","159277332962259038373819230337305650596","237236290568232077557772039139900423148","180457968412403266968871580820575060020","327638102212986462462613253127411016486","38723091438151364126203662112716903801","99327281077565237596237638722616676454","70771956055940442514103611574301114154","238903126193692026002511292991439891563","195684473951704409508435199910098250580","231555956337640560018995182152010878702","255139929340726860854940497238714522377","99696584944108590142116870465692648980","93462962690850773559063799952577930191","339247243719762617923998245640362203091","300711601678977675500312273942577174057","306588638952411099406294367822966981208","251395366070202027799766471937661800442","249202582981044249765944832152908063554","76556500147829156060421782426345474397","136264232653779121783890326769063058830","92738120461523380985125361837602253468","219826982428364864976721535260735555862","9049415267011868710637458840445109595","286291669991153824548096367066067053828","98910846400601129281228588491577562087","331534408072283819043959263106998216511","266876123468060425837349692411796422385","226205556155022545824726086175619679312","13930356082564812686641497261209747072","333652197313874704305069233691984767224","86729249360105357550977082728899404084","149872326295547015814450840415093637573","173293461433045764738928211450751841885","205143401831708319856548912441269424505","92114075067404545216439876663740088978","321945539358386543144912649928525527735","126003733485645612814243591221799262285","252918631493131629466358941772240744200","221706946219708874898279408568140528223","70884653159035777232845202050744207071","293532367585348628904380587182366884330","279465753748043362629592856209468276013","321713541218129354359134501552159635365","66141317601269381990930722373346404093","265914189137710878501435970383694224503","193256651345271320653915882789711502101","85105144633930760895147310103562796421","107064216111742402357169403178380858075","212482482017137678993385686063828964942","190382184412682793643566334129801046608","131836926299073607000850676604273177073","243263376936872426066240727253049197100","189304281280965121803968348893162653734","124366095656577635666805216782761989604","40901709608522125374407901737609453361","266184703796531326842035297192324158018","40441341997507990192095186480023439607","91006345527619672471004833949671159922","242709118015612958353883944562130046675","200819593335700233180127499082567313905","181286591184481977061934758501719844155","278723220769311247499919228993955892298","224715111592095733443532261902599176127","170653121223497309900093312140097435737","19243937041194360158428861038367376530","331113201223786572793190358454351614380","67913958500617820410901946186347173475","20651179879236507807464147290373526358","194718746540148520769966534963091212207","178523271164704246326456887243677450118","245830769106612973058803440866746633928","246847979328339062517738165087134841365","338975032917254496767129377491155212580","203009643533305933776626849985845858804","304364751512107999778585267126844116036","32829049020933655872984850794851562610","302488660153349705300335016541468653917","339232671415146652139856489785518189517","37841260507721331914560606348812993251","183388306268510381173096580486416178060","227262704784517115084462151903572483247","314870486803770577229333335318072590061","147700939216736698356495657829081937180","261033764337660433267403084288515898798","206557993401002521098725462965585416662","265316602099891106024119548103802070337","24068312239401476408245017665981352923","300383228833044936347369467563233942691","225751826730491106847785927814064134262","328081346322577238785494672871582437833","152451179862536172984655155336277447737","226463928213100435052757208019771926241","61606657192979605347144854346129821451","149967097950252586359171177206301737279","130879124585457640720703488867236553128","237465530034190923136148261293901193811","262885720192249134164973405235047879766","104890089065970680003641953896470634721","216652123161357772668784514968434437212","221594342311895409792689340792231839089","302225186056976114955327748882840254795","329039361082805838407276618897600188778","339991819557072122981866493682505832752","336214947890944072136654027599365935711","314045041489802156917334540197730754445","83397989580957482618907624747703856174","163422245301293612851533131499909292516","111304014077005892720682741658362924081","300943032359916777624097353737774269928","131069616700276082433629593518100572984","256665900386332609308637859317197876577","214548688038311445334944898267187306250","23019417524240884299715136954843590366","32829049020933655872984850794851562610","302488660153349705300335016541468653917","210724461037988518994546381770232098082","105511701335027176236589746081012876069","120697898135082776988151206565657083151","205837934119181808250698008702699621616","155696161930978924797794390557791469033","247805682558684699852102736026789629154","136264232653779121783890326769063058830","92738120461523380985125361837602253468","219826982428364864976721535260735555862","239137615714250089769240199660259094888","225574284112930683448932831387365000720","48460678264365564002732747017152548410","105190189377754821870220811539578628241","115869057082978814228017432876794371015","205296023498428960216432718814107126195","146404180447518317788332633883698749382","291753336733892058635761985744821159126","331771240488843035400356851427611537907","250818090424543981111138131325332457270","43352414597767353439965998885950315456","141066136651506695467983400595007146934"],"threshold":0.9},"id":"CVE-2026-93954-23852901","signature_type":"Line"},{"digest":{"function_hash":"31477323488453849738465782326553223432","length":3534},"id":"CVE-2026-93954-426c7825","signature_type":"Function","signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"buildAppSettings"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"getJsonSetting"},"deprecated":false,"digest":{"length":186,"function_hash":"152949242786563565575586630545426435671"},"id":"CVE-2026-93954-58a65f0d","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"97120896942614744383816184568871717102","length":656},"id":"CVE-2026-93954-6c52f073","signature_type":"Function","signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"buildPublicSetting"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/config/CacheConfig.java","function":"cacheManager"},"deprecated":false,"digest":{"function_hash":"132745470776610601921738565893307505277","length":197},"id":"CVE-2026-93954-769a526a"},{"signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"getJsonSetting"},"deprecated":false,"digest":{"function_hash":"272209877453113871968058419859665561236","length":406},"id":"CVE-2026-93954-850008e2","signature_type":"Function"},{"target":{"file":"backend/src/main/java/org/booklore/model/dto/settings/AppSettingKey.java"},"deprecated":false,"digest":{"line_hashes":["331224354523610469647581656858749379374","314998341648951815368074522621287575063","140155191201200488354240138559925627556","192934783794584319149809814787157145614","85891308794279052011809055172115067310","195102363888678203181620827753753735395","284101720493393432839188780487721838261","208123741667757427312940980078679653047","85587892748043417416690667686899841264","64588493852436341166857080042707860672","148759210456112124127925205704511025547","328885288597362853295244172170062752226","232140281129931574231044574896126723521","56051644518496598638392247344376957263","148078588766898339041382425094015184340","230520440825963648185380525241497673247","23942015681120003528609242518111629497","98502620007999112191678755430645228774","327715979092502253788095035305482521906","181752747442958136797327347697790900278","131422667347038302455309826999357993309","171144075693142794762723635012663873014","94366336637577588526733690898114371590","2312320812794399958142642405423226083","304758948730593912284019440142962491436","176212794745100256785357852225190392214","274856791417629758126035426453181849865"],"threshold":0.9},"id":"CVE-2026-93954-88a57478","signature_type":"Line","signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17"},{"digest":{"function_hash":"176268676195794364455847634348458519504","length":202},"id":"CVE-2026-93954-ab660319","signature_type":"Function","signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"getJsonListSetting"},"deprecated":false},{"source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"function":"getAppSettings","file":"backend/src/main/java/org/booklore/controller/AppSettingController.java"},"deprecated":false,"digest":{"function_hash":"231896767835136453833616448813715938781","length":64},"id":"CVE-2026-93954-abb653bb","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"updateSetting"},"deprecated":false,"digest":{"function_hash":"312583528449009617612539710145396992035","length":947},"id":"CVE-2026-93954-c1ac8916","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"128448417595845667156347657831470705847","length":44},"id":"CVE-2026-93954-cb98cfd9","signature_type":"Function","signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"getAppSettings"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"getPublicSettings"},"deprecated":false,"digest":{"function_hash":"128448417595845667156347657831470705847","length":44},"id":"CVE-2026-93954-ccb74e2f"},{"id":"CVE-2026-93954-df764a1e","signature_type":"Line","signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/controller/AppSettingController.java"},"deprecated":false,"digest":{"line_hashes":["330645517801960153084985618670651193886","203793375890097062010491899709126113537","283775085733830175661399521153381435811","204884529401718642462839504369342380798","119819320631190035360315231541368065243","169381608276686126802401189745501341651","298019885402929759576415071592885962295","201166182348985930434758831448522856700","172107486293972183109635538178480822946","210343781998701946078271626698860460276","60905114263453270032959533632765655855"],"threshold":0.9}},{"source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/config/CacheConfig.java"},"deprecated":false,"digest":{"line_hashes":["272851499601805193693899827436311617216","72003928223958155928734657809816634577","194840874829849486059132118162533957843","284479184232944571880629128278606609600","294308425832534871143651509407020440247","284317469695332738616852827524163848036","225741464103322220738903928504980194244","335442210009911658886893167026959784101","233020525184494268362094920017932253138","175344250084440880796594098905887807620","177188712789519718517424778323075611482","136170572802805197503369994867893976216","156490899321767661495435669664257409683","118506381245922881901978009295928794817","255409735442651956940924987377976909048","213841988721346610031193011507441913732","53394244852305136197203756565277152225"],"threshold":0.9},"id":"CVE-2026-93954-e1f72fbe","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/grimmory-tools/grimmory/commit/2b66ca6df8110f6b512e030b54c16b9fbe318f17","target":{"file":"backend/src/main/java/org/booklore/service/appsettings/AppSettingService.java","function":"getSettingsMap"},"deprecated":false,"digest":{"function_hash":"112219242425554902332471427936175285851","length":482},"id":"CVE-2026-93954-fe3a00eb","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]}