CVE-2026-7713

MediumCVSS 6.3

Published: 04/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A vulnerability was detected in Calibre-Web-Automated up to 4.0.6 in the generate_auth_token function of the file cps/kobo_auth.py (Kobo auth-token Route component). The manipulation results in improper authorization. The attack may be performed remotely and the exploit is now public.

Risk Assessment

An attacker could gain unauthorized access to functions requiring authorization, potentially hijacking Kobo authentication tokens. Public exploit availability increases the risk of exploitation.

Recommendation

Update Calibre-Web-Automated to version 4.0.7 (containing patch 9f50bb2c16160564c9f8777dc2ceed3eb95e4807). Until updated, restrict access to Kobo endpoints.

Other vulnerabilities in Calibre-Web-Automated

CVE-2026-7714Medium
A flaw was found in crocodilestick Calibre-Web-Automated up to 4.0.6 in unknown functionality of cps/cwa_functions.py (Admin Endpoint component). Manipulation causes missing authentication, and the attack can be initiated remotely. The exploit has been published and may be used; the project was informed but has not reacted yet.

Original NVD description (English source)

A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the file cps/kobo_auth.py of the component Kobo auth-token Route. The manipulation results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.0.7 addresses this issue. The patch is identified as 9f50bb2c16160564c9f8777dc2ceed3eb95e4807. The affected component should be upgraded.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS