CVE-2021-3987

Advisory

Affected versions of calibre-web are vulnerable to Missing Authorization (CWE-862). This vulnerability allows unauthorized users to create public shelves, potentially leading to unauthorized data exposure or manipulation. The attack vector involves exploiting the create_shelf method in shelf.py, which fails to verify user permissions before allowing shelf creation. This lack of proper access control enables attackers to perform actions beyond their intended privileges. To mitigate, upgrade to the version that implements proper permission checks in the create_shelf method, ensuring only authorized users can create public shelves.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-fj5v-w2jp-wqvj
• https://github.com/janeczku/calibre-web/commit/bcdc97641447965af486964537f3821f47b28874
• https://huntr.com/bounties/29fcc091-87b6-43bc-ab4b-3c0bec3f71df
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3987