Description

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-19T23:17:09.077Z",
  "pubdate": "2026-09-19T23:17:09.077Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified within the grimmory-tools grimmory application, specifically affecting the Download Endpoint located in the KoboController component.\nThe vulnerability allows remote, unauthenticated, or insufficiently authorized attackers to manipulate the bookId parameter, potentially leading to unauthorized access to restricted file resources.\nThis flaw resides in the streamFileToResponse function within backend/src/main/java/org/booklore/controller/KoboController.java, affecting all versions up to 3.3.3 and 3.4.1.\nThe risk is high, as the vulnerability facilitates remote exploitation, allowing attackers to exfiltrate data without adhering to established access control policies.\nGiven that exploit information is publicly available, the system is exposed to immediate risk of unauthorized data access and potential sensitive information disclosure.\nThe absence of a publicly documented fix or specific security patch necessitates immediate manual intervention or the implementation of compensating security controls to mitigate unauthorized access attempts.",
  "technicalDetails": "The vulnerability is situated in the backend/src/main/java/org/booklore/controller/KoboController.java file within the grimmory application. The affected function, streamFileToResponse, is responsible for managing file streaming operations initiated via the Download Endpoint.\nThe root cause of this vulnerability is an improper implementation of authorization logic within the endpoint's request handling mechanism. Specifically, the function fails to adequately validate the user's permissions or ownership relationship with the resource requested via the bookId parameter before executing the streaming operation.\nThe attack flow commences when a remote adversary sends a crafted HTTP request to the vulnerable Download Endpoint. By manipulating the bookId parameter, an attacker can bypass the intended authorization checks that would otherwise prevent unauthorized access to specific book files. The application backend processes the request and, due to the lack of sufficient access control verification within streamFileToResponse, proceeds to fetch and stream the requested file to the attacker's client.\nBecause the function directly consumes the user-provided bookId without performing server-side validation of the requester's identity or their authorization level, it creates a direct path for the retrieval of arbitrary files accessible to the application's file-handling service. This effectively negates the intended security boundary of the download feature.\nExploitation is feasible remotely, requiring no specific administrative privileges, as the lack of validation applies broadly to the endpoint. The attack surface includes all deployments running grimmory versions up to 3.3.3 and 3.4.1.\nPost-exploitation, an attacker can systematically enumerate or directly request unauthorized file resources, leading to a full bypass of the application's data protection model. This could result in the large-scale exfiltration of the application's book repository and other sensitive files accessible to the application process, contingent upon the permissions of the underlying service user account.\nNo official patch or specific commit has been identified for this issue, as indicated by the status of Issue #2431, which suggests that the vulnerability may have been reported through alternate channels, leaving active installations vulnerable to the publicly known exploit methodology."
}