CVE-2026-71209

HighCVSS 7.5

Published: 05/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.01%

79th percentile - higher than 79% of all known CVEs

Summary

Vulnerability in audiobookshelf: authentication exemption check incorrectly matches unauthenticated GET routes, and CacheManager joins decoded values into cache file paths, potentially leading to unauthorized file access.

Risk Assessment

Risk of unauthorized access to cache files and potentially user data.

Recommendation

Update audiobookshelf to a patched version or manually review authentication and cache handling logic.

Other vulnerabilities in audiobookshelf

CVE-2026-73085Medium
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.

Original NVD description (English source)

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.