CVE-2026-44775
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Kavita prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing unauthenticated access to page images from any chapter in any library. The apiKey parameter is not validated, and entity IDs are sequential, enabling easy enumeration of all server content.
Risk Assessment
An unauthenticated attacker can access all page images on the server, leading to content confidentiality breach.
Recommendation
Update Kavita to version 0.9.0 or later, which includes the fix.
Other vulnerabilities in Kavita
See all- CVE-2026-47202Critical
Improper token validation vulnerability in Kavita prior to 0.9.0.2. A remote, unauthenticated attacker can obtain a JWT for any user (including admins) given knowledge of their username.
- CVE-2026-44776Medium
Kavita, a cross-platform reading server, has a vulnerability in download and size-check endpoints. A low-privileged user can access content from libraries they are not assigned to if they know the chapter, volume, or series IDs.
Original NVD description (English source)
Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing completely unauthenticated access to page images from any chapter in any library. While the endpoint accepts an apiKey parameter, it is never validated. Since entity IDs are sequential integers, an unauthenticated attacker can trivially enumerate all content on the server. This vulnerability is fixed in 0.9.0.