CVE-2026-46487

GeoNetwork is a catalog application to manage spatially referenced resources.

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to…

3. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-46487