CVE-2026-44776
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Kavita, a cross-platform reading server, has a vulnerability in download and size-check endpoints. A low-privileged user can access content from libraries they are not assigned to if they know the chapter, volume, or series IDs.
Risk Assessment
An attacker can download full files, check sizes, and read metadata of content they should not have access to, compromising data confidentiality.
Recommendation
Upgrade Kavita to version 0.9.0 or later.
Other vulnerabilities in Kavita
See all- CVE-2026-47202Critical
Improper token validation vulnerability in Kavita prior to 0.9.0.2. A remote, unauthenticated attacker can obtain a JWT for any user (including admins) given knowledge of their username.
- CVE-2026-44775Medium
In Kavita prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing unauthenticated access to page images from any chapter in any library. The apiKey parameter is not validated, and entity IDs are sequential, enabling easy enumeration of all server content.
Original NVD description (English source)
Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization. A low-privileged user who knows or guesses a chapterId, volumeId, or seriesId belonging to a library they are not assigned to can download the full file contents, query file sizes, and read metadata for that content. This affects /api/Download/volume-size, /api/Download/chapter-size, /api/Download/series-size, /api/Download/volume, /api/Download/chapter, /api/Download/series, and /api/Chapter. This vulnerability is fixed in 0.9.0.