Uncontrolled Access in GeoNetwork's Elasticsearch Proxy for Metadata Retrieval
CVE-2026-46487
What is CVE-2026-46487?
GeoNetwork, a versatile catalog application designed for managing spatially referenced resources, contains a significant access control flaw in its Elasticsearch-backed search proxy. This issue arises in versions from 4.0.0-alpha.1 up to 4.2.16 and 4.4.11, where the application's access-control filter is bypassed if a client request omits a query field. Consequently, the affected search API inadvertently exposes sensitive metadata records to unauthenticated remote attackers. The vulnerability allows unauthorized individuals to access fully indexed contents that should remain confidential, thus compromising the integrity and confidentiality of the metadata. The problem has been addressed in the updates found in versions 4.2.16 and 4.4.11.
Affected Version(s)
core-geonetwork >= 4.0.0-alpha.1, <= 4.0.6-0 <= 4.0.0-alpha.1, 4.0.6-0
core-geonetwork >= 4.2.0, < 4.2.16 < 4.2.0, 4.2.16
core-geonetwork >= 4.4.0, < 4.4.11 < 4.4.0, 4.4.11