A flaw in VuFind’s request handling causes the application to continue executing a requested controller function even after reporting an access denied response. This incorrect access control allows an attacker to invoke privileged operations that are meant to be restricted, potentially exposing or manipulating sensitive catalog metadata. The weakness is identified as an improper authorization failure (CWE‑863).

The vulnerability affects the Open Library Foundation’s VuFind application, specifically versions 11.0.3 and 4.1. These releases are web‑based cataloging platforms and have been deployed by libraries and educational institutions worldwide.

The CVSS score of 9.8 reflects the high severity of this flaw, and although the EPSS score is less than 1 % and it is not listed in the CISA KEV catalog, the risk of exploitation remains significant because the bug can be triggered via a standard HTTP request to any controller endpoint guarded by ACLs. An adversary can craft a request that receives a 403 response yet still causes the protected method to execute, enabling arbitrary privileged actions without needing an authenticated session or elevated privileges.