VulDB Identifies Dual Authorization Flaws in Grimmory Software

Key facts

According to disclosures published by VulDB on September 19, 2026, researchers identified two distinct authorization flaws within the codebase of grimmory-tools grimmory. The software versions affected by both vulnerability notices include releases up to version 3.3.3 as well as version 3.4.1.

The first issue, logged as CVE-2026-93954, centers on an authorization weakness located inside AppSettingController.java. Specifically, the system's getAppSettings method, which services requests to the Settings API endpoint, fails to properly validate user permissions prior to returning administrative or application-wide configuration parameters. In standard web architecture models, application settings controllers handle metadata, system flags, and operational parameters; improper access verification on such endpoints permits unauthenticated or low-privileged actors to inspect configuration details that ought to remain restricted to higher privilege levels.

The second vulnerability, cataloged as CVE-2026-93955, involves an authorization flaw located within KoboController.java. The affected logic resides inside the streamFileToResponse method, which manages file transfer operations and file streaming directly to client requests. Because the authorization checks inside this endpoint are incomplete or improperly enforced, unauthenticated or unauthorized users can potentially request and download restricted files stored within or served by the application environment.

Both security issues were publicly logged by VulDB on September 19, 2026, with CVE-2026-93954 recorded at 08:56:23 UTC and CVE-2026-93955 following shortly thereafter at 08:56:27 UTC. VulDB marked both issues as requiring patch implementation to restore secure access control behavior across affected software installations.

Why it matters

Authorization flaws represent a severe class of web application vulnerabilities because they bypass intended security boundaries without requiring complex exploit payloads or encryption breaking. When endpoints handling core application configuration settings and file streaming fail to perform permission checks, the confidentiality and integrity of the system are directly compromised.

In the case of CVE-2026-93954, exposure of the getAppSettings endpoint through AppSettingController.java can reveal internal system state, API keys, database connection parameters, structural paths, or service metadata. Such leaked data frequently provides attackers with the necessary context to engineer secondary attacks against exposed infrastructure.

For CVE-2026-93955, an authorization bypass in streamFileToResponse within KoboController.java creates an immediate risk of unauthorized data exfiltration. If file retrieval logic does not restrict file output to authenticated download requests possessing explicit rights to the requested resource, arbitrary media, documents, or private database stores can be retrieved by remote actors.

Under the Open Web Application Security Project (OWASP) Top 10 security framework, Broken Access Control regularly ranks as the single most prevalent and impactful software vulnerability category. Unlike memory corruption flaws that require architecture-specific assembly code, access control weaknesses can often be exploited through simple HTTP requests directed at exposed controller methods. For organizations, self-hosters, and system administrators running Grimmory, failure to remediate these authorization gaps leaves host environments vulnerable to automated scraping, exposure of sensitive user files, and structural reconnaissance by external threat actors.

Modern Java-based web application frameworks rely on controller classes to map incoming HTTP requests to specific backend methods. Controller components such as AppSettingController.java and KoboController.java act as front-line dispatchers, converting incoming network requests into programmatic operations.

In well-designed software architectures, every exposed controller method must enforce access control checks prior to executing business logic or accessing local resources. Access control enforcement typically occurs through annotations, security filter chains, or programmatic role checks (such as verifying user session tokens, JSON Web Tokens, or access control lists). When a developer omits these checks or fails to bind a route to the global security context, the endpoint becomes publicly accessible to any entity capable of routing HTTP requests to the server.

Vulnerabilities of this nature are classified as Broken Object Level Authorization (BOLA) or Missing Function Level Access Control. In file-streaming endpoints like streamFileToResponse, authorization checks must ensure that the authenticated user possesses explicit permission to view the targeted file path, preventing directory traversal or unauthorized file disclosure. In settings endpoints like getAppSettings, access should be strictly limited to administrative role descriptors.

Tracking and documenting these security defects relies on global vulnerability management frameworks. The Common Vulnerabilities and Exposures (CVE) program, overseen by MITRE Corporation alongside authorized CVE Numbering Authorities (CNAs) and independent vulnerability platforms like VulDB, provides standardized nomenclature for reporting defects. Disclosures on platforms such as VulDB allow software maintainers, enterprise administrators, and security operations centers to cross-reference software inventories against known exposure vectors and coordinate patch distribution across distributed deployment bases.

Reaction

At the time of disclosure, formal statements from the primary development team behind grimmory-tools grimmory regarding the specific code changes implemented for CVE-2026-93954 and CVE-2026-93955 have not been publicly detailed beyond the security advisory notes published by VulDB.

Security databases advise system administrators and deployment engineers utilizing affected software builds (versions up to 3.3.3 and 3.4.1) to apply the latest maintenance releases or source code patches provided by the software project. In open-source and self-hosted application ecosystems, maintainers typically release code commits updating controller annotations or adding explicit permission validation statements to target classes such as AppSettingController.java and KoboController.java.

Organizations and individual hosters managing Grimmory instances are expected to inspect their deployment configurations, monitor incoming network traffic for anomalous GET or POST requests directed toward settings and streaming controllers, and restrict network access to trusted IP ranges until patch confirmation is verified.

What we don't know yet

Several critical details regarding CVE-2026-93954 and CVE-2026-93955 remain open questions in the current public tracking record:

Understanding these details is critical for security teams assessing the urgency of patch deployment and establishing threat prioritization within corporate or personal networks.

What to watch

This report is based on vulnerability disclosure records published by VulDB on September 19, 2026.