CVE-2026-46487

GeoNetwork (versions 4.0.0-alpha.1 through 4.4.10 ) is vulnerable to an Access Control List (ACL) bypass (CWE-862) in its Elasticsearch-backed search API. The vulnerability occurs because the search proxy layer fails to inject required access-control and visibility filters when a client request o...