Missing Authorization in Calibre - #VU140779
Published: August 3, 2026
Vulnerability identifier: #VU140779
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to modify server-side annotation data.
The vulnerability exists due to missing authorization in the /book-update-annotations endpoint when handling POST requests that merge and persist annotation JSON for a readable book. A remote attacker can send a specially crafted request to modify server-side annotation data.
Only books the caller is allowed to access can be targeted, and deployments with readonly users or anonymous network access are affected.
Affected software
Calibre
Remediation
Install security update from vendor's website.
Calibre - update to 9.12.0