Missing Authorization Affecting org.geonetwork-opensource:gn-services package, versions [4.0.0-alpha.1,4.2.16)[4.4.0,4.4.11)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGGEONETWORKOPENSOURCE-17817215
- published4 Jul 2026
- disclosed1 Jul 2026
- creditUnknown
Introduced: 1 Jul 2026
CVE-2026-46487 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade org.geonetwork-opensource:gn-services to version 4.2.16, 4.4.11 or higher.
Overview
org.geonetwork-opensource:gn-services is a GeoNetwork Services.
Affected versions of this package are vulnerable to Missing Authorization due to the omission of the query field in the request body, which causes the access-control filter-injection process to be skipped. An attacker can access sensitive metadata records by submitting specially crafted search requests that bypass intended access restrictions.