A flaw in VuFind causes the application to continue executing a requested function even after an access‑denied response is returned. The result is that an attacker can invoke privileged actions that the user should not be able to perform, potentially exposing or manipulating confidential data. The vulnerability is an example of incorrect access control (CWE‑284).

The vulnerable product is VuFind, with affected versions 11.0.3 and 4.1. These are web‑based cataloging application releases maintained by the Open Library Foundation.

The CVSS score is not disclosed and EPSS data is unavailable, but the issue is not listed in the CISA KEV catalog. The flaw can be exploited by sending a crafted HTTP request to any controller method that is protected by access permissions; the application will report a 403 but still execute the method. Because the violation occurs before the response is generated, an attacker can bypass normal authorization checks with the same request vector that would ordinarily be blocked.