CVE-2026-46487
GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field
GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.
Fixes and workarounds
Fix
org.geonetwork-opensource:geonetwork (Maven): OSV reports a fixed version 4.2.16. Check the advisory for supported release branches.
Source: OSV GHSA-582q-v28r-7cxrFix
org.geonetwork-opensource:geonetwork (Maven): OSV reports a fixed version 4.4.11. Check the advisory for supported release branches.
Source: OSV GHSA-582q-v28r-7cxrAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| core-geonetwork geonetwork |
>= 4.0.0-alpha.1, <= 4.0.6-0 (affected) >= 4.2.0, < 4.2.16 (affected) >= 4.4.0, < 4.4.11 (affected) |
CNA: GitHub_M |
org.geonetwork-opensource:geonetworkorg.geonetwork-opensource:geonetwork
Maven |
Ecosystem version events: introduced 4.0.0-alpha.1; last affected 4.0.6-0Source events (ECOSYSTEM)Other versions: unaffected |
OSV GHSA-582q-v28r-7cxr |
org.geonetwork-opensource:geonetworkorg.geonetwork-opensource:geonetwork
Maven |
Ecosystem version events: introduced 4.2.0; fixed 4.2.16Source events (ECOSYSTEM)Other versions: unaffected |
OSV GHSA-582q-v28r-7cxr |
org.geonetwork-opensource:geonetworkorg.geonetwork-opensource:geonetwork
Maven |
Ecosystem version events: introduced 4.4.0; fixed 4.4.11Source events (ECOSYSTEM)Other versions: unaffected |
OSV GHSA-582q-v28r-7cxr |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CNA: GitHub_M |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxrCNA: GitHub_M · x_refsource_CONFIRM
- https://github.com/geonetwork/core-geonetwork/commit/1916412d38999f2eff68bad2dfccd69340d20f3fCNA: GitHub_M · x_refsource_MISC
- https://github.com/geonetwork/core-geonetwork/commit/6c756c63cd1fa942f3832d99c64380c69c5e8be9CNA: GitHub_M · x_refsource_MISC
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16CNA: GitHub_M · x_refsource_MISC
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11CNA: GitHub_M · x_refsource_MISC
- https://github.com/advisories/GHSA-582q-v28r-7cxrOSV / GitHub Security Advisories · advisory
- https://osv.dev/vulnerability/GHSA-582q-v28r-7cxrOSV / GitHub Security Advisories · osv
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.