CVE-2026-46487: 
Java vulnerability analysis and mitigation

CVE-2026-46487 is an authorization bypass vulnerability in GeoNetwork's Elasticsearch-backed search API, classified as "ACL bypass on Elasticsearch search when request body omits query field." It affects GeoNetwork versions 4.0.0-alpha.1 through 4.0.6-0, 4.2.0 through 4.2.15, and 4.4.0 through 4.4.10, all under the Maven package org.geonetwork-opensource:geonetwork. The vulnerability was published and disclosed on July 1, 2026, with patched versions released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, GeoNetwork Advisory).

The root cause is CWE-862 (Missing Authorization): GeoNetwork's search proxy layer is responsible for injecting access-control and visibility filter clauses into every Elasticsearch request before forwarding it to the underlying index. A flaw in how the filter-injection step is triggered allows it to be bypassed when the client-supplied request body omits the query field. Under this condition, the request reaches Elasticsearch without GeoNetwork's access restrictions applied, exposing records that should be restricted. The bypassed filter step enforces group-based record visibility, draft record exclusion, record ownership checks, and portal-specific filtering simultaneously (GitHub Advisory, GeoNetwork Advisory).

Successful exploitation allows an unauthenticated remote attacker to retrieve the full contents of metadata records that should not be publicly visible, including records restricted to specific user groups, draft records, and portal-specific content. The impact is limited to confidentiality — integrity and availability are not affected. Any public-facing GeoNetwork 4.x instance through version 4.4.10 is at risk of exposing sensitive geospatial metadata to unauthorized parties (GitHub Advisory).

The vulnerability requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any network-accessible attacker. No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been identified for this vulnerability (GitHub Advisory, GeoNetwork Advisory).

1. Reconnaissance: Identify public-facing GeoNetwork 4.x instances (versions 4.0.0-alpha.1 through 4.4.10) using search engines like Shodan or Censys, or by directly probing known GeoNetwork API endpoints.
2. Craft a bypass request: Construct an HTTP POST request to GeoNetwork's Elasticsearch search API endpoint (e.g., /geonetwork/srv/api/search/records/_search) with a request body that omits the query field entirely.
3. Submit the request unauthenticated: Send the crafted request without any authentication credentials or session tokens.
4. Receive unrestricted results: Because the filter-injection step is skipped, Elasticsearch returns metadata records without applying group-based visibility, draft exclusion, ownership, or portal filters — exposing restricted records in the response (GitHub Advisory, GeoNetwork Advisory).

• Network: Unusual or repeated unauthenticated POST requests to GeoNetwork's Elasticsearch search API endpoint (e.g., /geonetwork/srv/api/search/records/_search) with request bodies lacking a query field; large volumes of search responses returned to unauthenticated clients.
• Logs: GeoNetwork access logs showing search API calls from unauthenticated sessions returning high volumes of metadata records; absence of expected filter clauses in proxied Elasticsearch queries logged at the application layer.
• Application Behavior: Elasticsearch query logs showing requests without GeoNetwork's standard access-control filter clauses appended, particularly from external IP addresses.

GeoNetwork has released patched versions 4.2.16 and 4.4.11, which fix the filter-injection flaw. Administrators running any GeoNetwork 4.x instance (4.0.0-alpha.1 through 4.4.10) should upgrade to the patched versions immediately. No specific configuration-based workaround has been published; upgrading is the recommended remediation. Instances in the 4.0.x branch (up to 4.0.6-0) should migrate to a supported and patched release (GitHub Advisory, GeoNetwork Advisory).