CVE-2026-93955: Grimmory Authorization Bypass Vulnerability

CVE-2026-93955 Overview

CVE-2026-93955 is an authorization bypass vulnerability in grimmory-tools grimmory versions up to 3.3.3 and 3.4.1. The flaw resides in the streamFileToResponse function within backend/src/main/java/org/booklore/controller/KoboController.java, part of the Download Endpoint component. An authenticated remote attacker can manipulate the bookId argument to access resources without proper authorization checks [CWE-285]. A public exploit exists, but no fixing commit or pull request has been identified in the project's issue tracker.

Critical Impact

Authenticated attackers can bypass authorization controls on the Kobo download endpoint by tampering with the bookId parameter, exposing files intended for other users.

Affected Products

• grimmory-tools grimmory 3.3.3
• grimmory-tools grimmory 3.4.1
• Deployments using the KoboController download endpoint

Discovery Timeline

• 2026-09-19 - CVE-2026-93955 published to NVD
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-93955

Vulnerability Analysis

The vulnerability lives in the streamFileToResponse method of KoboController.java, which handles book downloads through the Kobo integration path. The controller accepts a user-supplied bookId parameter and streams the corresponding file back in the HTTP response. The endpoint does not verify that the authenticated principal is actually authorized to access the requested bookId. As a result, a low-privileged user can request identifiers belonging to other users and receive the underlying file content. Exploitation requires only network access and valid low-privileged credentials.

Root Cause

The root cause is missing authorization enforcement on a direct object reference [CWE-285]. The bookId argument functions as an insecure direct object reference. The controller trusts the identifier without cross-checking ownership or access control lists against the authenticated session. This is a classic broken access control pattern in Spring-style Java REST controllers where authentication is enforced globally but per-object authorization is omitted.

Attack Vector

An attacker authenticates to the grimmory backend with any valid low-privileged account. The attacker then issues HTTP requests to the Kobo download endpoint while iterating or guessing values for the bookId parameter. Each successful response returns file content the caller was never entitled to read. The attack is fully remote and requires no user interaction. Confidentiality impact is limited; integrity and availability are not affected.

A public exploit is referenced in VulDB CVE-2026-93955 and discussion appears in GitHub Grimmory Tools Issue #2431. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-93955

Indicators of Compromise

• Repeated HTTP requests to the Kobo download route with sequential or enumerated bookId values from a single session.
• Download activity where the requested bookId does not appear in the requesting user's library or prior browsing history.
• Unusual volume of successful download responses served to a single low-privileged account within a short window.

Detection Strategies

• Enable application-level audit logging on KoboController.streamFileToResponse capturing the authenticated principal and requested bookId.
• Correlate download events against book ownership records to flag cross-user access.
• Deploy web application firewall rules to rate-limit and alert on rapid enumeration of the download endpoint.

Monitoring Recommendations

• Ingest grimmory backend logs into a centralized SIEM for behavioral analysis of authenticated download activity.
• Alert on any single account requesting more distinct bookId values than a defined threshold per hour.
• Review reverse proxy access logs for unusual User-Agent strings or scripted request patterns targeting the Kobo endpoint.

How to Mitigate CVE-2026-93955

Immediate Actions Required

• Restrict network exposure of the grimmory backend to trusted users and networks until a fix is available.
• Audit existing accounts and revoke credentials for any unused or low-trust users.
• Review download logs for evidence of unauthorized bookId access and notify affected users if data exposure is confirmed.

Patch Information

No fixing commit or pull request has been identified. GitHub Grimmory Tools Issue #2431 was closed as completed, but its only comment states the issue "has already been reported elsewhere." Monitor the GitHub Grimmory Tools Repository for a security release addressing versions 3.3.3 and 3.4.1.

Workarounds

• Add an authorization check in streamFileToResponse that validates the authenticated user owns or is entitled to the requested bookId before streaming the file.
• Place the Kobo download endpoint behind a reverse proxy that enforces per-user request quotas.
• Temporarily disable the Kobo integration route if it is not required by your deployment.

# Example nginx rule to rate-limit the Kobo download endpoint
limit_req_zone $binary_remote_addr zone=kobo_dl:10m rate=10r/m;

location /api/kobo/ {
    limit_req zone=kobo_dl burst=5 nodelay;
    proxy_pass http://grimmory_backend;
}