CVE-2026-46487

HIGH 7.5

GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.

CWE	CWE-862
Vendor	geonetwork
Product	core-geonetwork
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for geonetwork core-geonetwork

Be the first to know when new high vulnerabilities affecting geonetwork core-geonetwork are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

geonetwork / core-geonetwork

>= 4.0.0-alpha.1, <= 4.0.6-0 >= 4.2.0, < 4.2.16 >= 4.4.0, < 4.4.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr github.com: https://github.com/geonetwork/core-geonetwork/commit/1916412d38999f2eff68bad2dfccd69340d20f3f github.com: https://github.com/geonetwork/core-geonetwork/commit/6c756c63cd1fa942f3832d99c64380c69c5e8be9 github.com: https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16 github.com: https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11