CVE-2026-93955: grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization
A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low-privileged access can exploit it. No user interaction is required, and the affected download endpoint is exposed over the network.
What does an attacker need to manipulate?
The issue is triggered by manipulating the bookId argument handled by KoboController.java's streamFileToResponse function. This can bypass authorization checks for the download endpoint.
Are fixed versions available?
The affected range is reported as grimmory-tools grimmory up to versions 3.3.3 and 3.4.1. The available issue reference is closed, but no fixing commit or pull request is identified in the provided information.
How urgent is remediation?
Public exploit availability is reported, and exploitation has low complexity. Prioritize restricting access to the download endpoint and reviewing authorization around bookId requests if an upgrade or verified fix is not immediately available.