What is the CVSS score of CVE-2026-42883?

CVE-2026-42883 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42883?

Yes, a patch is available for CVE-2026-42883. Update the affected software to the latest version immediately.

Audiobookshelf CVE-2026-42883

EUVD-2026-29206 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-11 GitHub_M

Authentication Bypass Audiobookshelf

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 11, 2026 - 21:03 EUVD

Analysis Generated

May 11, 2026 - 20:31 vuln.today

CVE Published

May 11, 2026 - 19:51 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/libraries/:id/download endpoint validates that the requesting user has access to the library specified in the URL path, but fetches downloadable items solely by attacker-provided IDs without constraining them to that library. An authenticated user with download permission and access to any one library can exfiltrate the full file contents of items belonging to any other library, including libraries they are explicitly denied access to. This vulnerability is fixed in 2.32.2.

AnalysisAI

Authenticated users with download permissions in Audiobookshelf prior to 2.32.2 can download files from libraries they do not have access to by directly specifying item IDs in the GET /api/libraries/:id/download endpoint, bypassing library access controls. An attacker with valid credentials and access to any single library can exfiltrate complete file contents from restricted libraries, including those explicitly denied to them.

Technical ContextAI

Audiobookshelf's download endpoint implements two-stage authorization: it validates that the requesting user has access to the library in the URL path parameter, but then retrieves downloadable items using only the attacker-supplied item ID without re-validating that the item belongs to the authorized library. This is a broken access control vulnerability (CWE-863: Incorrect Authorization) stemming from insufficient object-level authorization checks. The endpoint fails to constrain item lookups to the library scope established during the initial validation, allowing authenticated users to traverse across library boundaries using direct object references (IDOR pattern).

RemediationAI

Upgrade Audiobookshelf to version 2.32.2 or later immediately, as the vendor has released a patched version that corrects the authorization bypass. Apply this upgrade across all instances of Audiobookshelf in your environment. Until patching is possible, restrict download API access to trusted networks using a reverse proxy or firewall rule (e.g., block or require additional authentication for /api/libraries/*/download endpoints), but note this is a partial mitigation that reduces usability. Alternatively, audit and temporarily revoke download permissions for all but the most trusted users, though this degrades functionality. The most effective interim control is network segmentation: isolate Audiobookshelf from untrusted networks and enforce strict role-based access controls, limiting download permission to users who require it. However, these workarounds do not address the underlying flaw and should be treated as temporary measures pending patching. Consult the official GitHub Security Advisory at https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-6rvg-w3f5-9gq5 for additional context and confirmation of patch availability.