Audiobookshelf CVE-2026-42883

The attacker must be an authenticated user with download permissions granted for at least one library in the Audiobookshelf instance. The vulnerability is triggered when an attacker requests the /api/libraries/:id/download endpoint using a library ID they are authorized to access in the URL path, but specifies an itemId parameter pointing to a file in a different library. The authorization flaw exists because the server validates library-level access based on the URL parameter but does not constrain the item lookup to that library; it retrieves any item by ID regardless of library membership. No special configuration, non-default settings, or privileged roles are required - standard authenticated users with basic download permissions can exploit this. The vulnerability is limited by requiring prior authentication (PR:L in CVSS), but not by user interaction, non-default configuration, or platform-specific factors. An attacker without any account cannot exploit this; however, any valid account with download permission becomes a potential vector.

CVSS 6.5 (Network, Low Complexity, Low Privilege) with High Confidentiality Impact reflects realistic risk: the vulnerability requires valid authentication and download permission (non-zero privilege requirement) but is otherwise straightforward to exploit remotely without user interaction. The Low Complexity and Network attack vector indicate no special configuration or bypass techniques are needed - any authenticated user meeting the stated permissions can immediately exploit this. EPSS data not provided in input, limiting correlation with empirical exploitation likelihood. CISA KEV status not confirmed in input. The severity is driven entirely by confidentiality impact (full file exfiltration) with no integrity or availability damage; this is a data disclosure vulnerability, not remote code execution. Real-world risk depends heavily on deployment context: organizations using Audiobookshelf with sensitive audiobooks, proprietary podcasts, or restricted library segments face direct business/compliance impact. The attack requires no social engineering or advanced techniques - it exploits a straightforward authorization logic flaw discoverable by any authenticated user.

An authenticated user with download permissions for Library A logs into Audiobookshelf and discovers the item ID of a restricted file in Library B (via error messages, metadata leakage, or prior reconnaissance). The attacker directly requests GET /api/libraries/[LibraryA_ID]/download?itemId=[LibraryB_item_ID], and the server validates their access to Library A, then fetches and returns the full contents of the Library B file without re-checking authorization. The attacker downloads sensitive or proprietary content they should never have accessed.