Read the docs
TI-2026-84467 Aliases CVE-2026-46487

Access control bypass in GeoNetwork Elasticsearch search proxy

Priority LOW 39CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

GeoNetwork from 4.0.0-alpha.1 through 4.0.6-0, from 4.2.0 before 4.2.16 and from 4.4.0 before 4.4.11 is affected. The Elasticsearch-backed search proxy skips its access-control filters when a request omits the query field (CWE-862, Missing Authorization). An unauthenticated remote attacker can use the public search API to retrieve the full indexed contents of metadata records that should not be publicly visible.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00463 40th percentileScored 2026-11-07
Fix Fixed core-geonetwork (geonetwork): 4.2.16, 4.4.11org.geonetwork-opensource:geonetwork (Maven): 4.2.16, 4.4.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
geonetworkcore-geonetwork4.0.0-alpha.1 – 4.0.6-0; 4.2.0 to before 4.2.16; 4.4.0 to before 4.4.114.2.16, 4.4.11Patch availableCNA
—org.geonetwork-opensource:geonetwork (Maven)4.0.0-alpha.1 – 4.0.6-0—No fix listedGHSA-582q-v28r-7cxr
—org.geonetwork-opensource:geonetwork (Maven)4.2.0 to before 4.2.164.2.16Patch availableGHSA-582q-v28r-7cxr
—org.geonetwork-opensource:geonetwork (Maven)4.4.0 to before 4.4.114.4.11Patch availableGHSA-582q-v28r-7cxr
  • core-geonetwork Vendorgeonetwork Affected 4.0.0-alpha.1 – 4.0.6-0; 4.2.0 to before 4.2.16; 4.4.0 to before 4.4.11 Fixed in 4.2.16, 4.4.11 Patch available CNA
  • org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 4.0.0-alpha.1 – 4.0.6-0 Fixed in — No fix listed GHSA-582q-v28r-7cxr
  • org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 4.2.0 to before 4.2.16 Fixed in 4.2.16 Patch available GHSA-582q-v28r-7cxr
  • org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 4.4.0 to before 4.4.11 Fixed in 4.4.11 Patch available GHSA-582q-v28r-7cxr

Remediation

Upgrade core-geonetwork to 4.2.16 or 4.4.11. Upgrade the Maven package org.geonetwork-opensource:geonetwork to 4.2.16 or 4.4.11, whichever matches the affected branch. No fixed version is listed for org.geonetwork-opensource:geonetwork in the 4.0.0-alpha.1 through 4.0.6-0 range.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA core-geonetwork (geonetwork) Fixed in 4.2.16, 4.4.11
  • Fix · GHSA-582q-v28r-7cxr org.geonetwork-opensource:geonetwork (Maven) Fixed in 4.2.16 Advisory →
  • Fix · GHSA-582q-v28r-7cxr org.geonetwork-opensource:geonetwork (Maven) Fixed in 4.4.11 Advisory →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-46487
  2. 2026-11-05 Priority changed: MEDIUM → LOW
  3. 2026-11-07 CISA SSVC decision points changed

References

Other 6

  • TI-2026-45097 Unauthenticated file upload via missing authorization on formatter upload endpoint CVSS 3.1HIGH 8.6
  • TI-2026-42016 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter CVSS 3.1CRITICAL 9.1
  • TI-2022-26353 Geonetwork 4.2.0 - XML External Entity (XXE) CVSS 4.0HIGH 8.7
  • TI-2026-40323 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool CVSS 4.0HIGH 7.8
  • TI-2006-05324 SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers… CVSS 2.0HIGH 7.5
  • TI-2026-84477 Reflected XSS in GeoNetwork through AngularJS template injection CVSS 3.1HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences