What is the CVSS score of CVE-2026-42884?

CVE-2026-42884 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42884?

Yes, a patch is available for CVE-2026-42884. Update the affected software to the latest version immediately.

Audiobookshelf CVE-2026-42884

EUVD-2026-29207 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-11 GitHub_M

Authentication Bypass Audiobookshelf

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 11, 2026 - 21:03 EUVD

Analysis Generated

May 11, 2026 - 20:31 vuln.today

CVE Published

May 11, 2026 - 19:52 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collections and GET /api/collections/:id endpoints return collections from all libraries without checking whether the requesting user has access to each collection's library. An authenticated user with access to any library can enumerate and read collections (including full book metadata) from libraries they are explicitly restricted from accessing. This vulnerability is fixed in 2.32.2.

AnalysisAI

Audiobookshelf prior to version 2.32.2 fails to enforce library access controls on the GET /api/collections and GET /api/collections/:id endpoints, allowing authenticated users to enumerate and retrieve collection metadata and book information from libraries they are not authorized to access. An attacker with valid credentials to any library can exploit this privilege escalation to discover sensitive metadata across all libraries in a multi-library installation.

Technical ContextAI

Audiobookshelf is a self-hosted server application that manages audiobook and podcast libraries with role-based access control. The vulnerability exists in the API layer where collection retrieval endpoints (GET /api/collections and GET /api/collections/:id) fail to perform library-level authorization checks despite requiring user authentication. The root cause, classified as CWE-863 (Incorrect Authorization), stems from missing access control validation that should verify whether the authenticated user has permissions to the specific library before returning its collections. The application uses an authentication mechanism (evidenced by PR:L in CVSS), but this authentication is not properly gated to restrict data visibility by library membership.

RemediationAI

Upgrade Audiobookshelf to version 2.32.2 or later immediately to receive the authorization fix. This is the primary and only vendor-released remediation. As a temporary compensating control pending upgrade, restrict network access to the /api/collections endpoints using a reverse proxy or API gateway, allowing requests only from trusted internal networks, though this does not address the underlying privilege escalation within the application. Alternatively, audit and minimize the number of libraries each user account has access to, reducing the exposure of unauthorized collection enumeration. These workarounds are incomplete and should not delay patching; they do not prevent exploitation if an attacker has any legitimate library access.