SB20260505102 - Missing Authentication for Critical Function in Kavita

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-44775)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive image data.

The vulnerability exists due to missing authentication for critical function in the /api/Reader/image endpoint when handling image requests. A remote attacker can send a specially crafted request with chapterId and page values to disclose sensitive image data.

The apiKey parameter is accepted but not validated, and sequential chapter identifiers allow trivial enumeration of page images across libraries.

Remediation

Install update from vendor's website.

References

• https://github.com/Kareadita/Kavita/security/advisories/GHSA-6gc9-6r8p-5wg2
• https://github.com/Kareadita/Kavita/blob/8c686df2dbc2d0a83120e8b3f8c1269107bb815d/API/Controllers/ReaderController.cs#L116-L133