CVE-2026-7709

MediumCVSS 6.3

Published: 03/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

A vulnerability was identified in janeczku Calibre-Web up to 0.6.26 in the generate_auth_token function of cps/kobo_auth.py. Manipulation of the user_id argument leads to improper authorization, and the attack can be launched remotely.

Risk Assessment

A remote attacker can gain unauthorized access to application resources or functions by manipulating the user identifier. This may lead to a breach of library data confidentiality.

Recommendation

Upgrade Calibre-Web to a patched version when available. Until fixed, restrict access to the token generation endpoint.

Other vulnerabilities in Calibre-Web

CVE-2025-65858Low
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.

Original NVD description (English source)

A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of the component Endpoint. Such manipulation of the argument user_id leads to improper authorization. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS