CVE-2026-46487highCWE-862

CVE-2026-46487: high-severity vulnerability in geonetwork core-geonetwork

GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field

Published

Follow this CVE+ Monitor core-geonetwork+ Monitor org.geonetwork-opensource:geonetwork

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.5%
GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
geonetwork · core-geonetwork
Related CVEs — geonetwork core-geonetwork

In the same product, most dangerous first.

CVE-2026-55864HIGHGeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD ToolEPSS 1.4%CVE-2026-58400CRITICALGeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatterEPSS 1.2%CVE-2026-53573MEDIUMcore-geonetwork has an Open Redirect BypassEPSS 0.6%CVE-2026-63219HIGHUnauthenticated file upload via missing authorization on formatter upload endpointEPSS 0.5%CVE-2024-32037NONEGeoNetwork vulnerable to search end-point information disclosure in response headersEPSS 0.4%CVE-2026-39379HIGHGeoNetwork: Reflected XSS through client-side template injectionEPSS 0.4%