CVE-2026-93955: Grimmory-Tools Grimmory

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.

Affected products

• Grimmory-Tools Grimmory: version 3.3.0 only; version 3.3.1 only; version 3.3.2 only; version 3.3.3 only; version 3.4.0 only; version 3.4.1 only

Published 2026-09-19. Last modified 2026-09-21.