Missing Authorization in Kavita - #VU147281
Published: September 7, 2026
Vulnerability identifier: #VU147281
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify global CSS themes.
The vulnerability exists due to missing authorization in the theme upload, deletion, and upstream download actions of ThemeController when handling theme management requests. A remote user can upload arbitrary CSS content or delete themes uploaded by other users to modify global CSS themes.
Uploaded theme content is globally listed and can be retrieved without authentication.
Affected software
Kavita
Remediation
Install security update from vendor's website.
Kavita - update to 0.9.1.0