GeoNetwork’s Elasticsearch‑backed search proxy has a flaw that allows a client request lacking a query field to bypass the application’s access‑control filter injection. The request is forwarded directly to Elasticsearch, stripping away group visibility, draft exclusion, record ownership, and portal‑specific filtering. This results in the ability of an unauthenticated attacker to retrieve full indexed contents of metadata records that are not intended for public view, thereby exposing sensitive geospatial data.

The vulnerability exists in GeoNetwork versions from 4.0.0‑alpha.1 up through 4.2.16 and 4.4.11. Users running any of these releases are affected; versions 4.2.16 and 4.4.11 contain a fix.

The CVSS score of 7.5 indicates a high severity condition for unauthorized data disclosure. The EPSS score is currently not available, so the likelihood of exploitation cannot be quantified at this time, and the issue is not listed in the CISA KEV catalog. The vulnerability can be exploited remotely by sending a specially crafted search request that omits the query field to a public search API endpoint. Attackers need no authentication, only network access to the API.