EUVD-2026-83611
GHSA-frhf-rqp4-m3jc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitCall Kobo download endpoint with foreign bookId
-
ExecutionServer skips ownership/authorization check
-
ImpactStream and exfiltrate other users' book files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated low-privilege account (PR:L) on a grimmory/BookLore instance exposing the Kobo download endpoint handled by KoboController.streamFileToResponse. Exploitation consists of supplying another user's bookId to that endpoint; no user interaction, special client, or non-default configuration is indicated beyond having the Kobo download feature reachable. Limiting factors: valid credentials are needed (not fully anonymous), impact is limited to reading book files (confidentiality only), and the affected product is a niche self-hosted application, so exposure depends on the instance being network-reachable to the attacker. |
| Impact | This is a real but moderate-severity authorization flaw (IDOR), not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L, base 5.3) is internally consistent: network-reachable, low complexity, but requiring authentication (PR:L) and yielding only low confidentiality impact (VC:L) with no integrity or availability effect. The vector explicitly carries E:P (Proof-of-Concept exploit maturity), aligning with the stated public POC. There is no EPSS score and no CISA KEV listing in the provided data, so there is no signal of widespread or automated exploitation - the public exploit indicates capability, not observed activity. The CWE-639 classification (Authorization Bypass Through User-Controlled Key) matches the description far better than the input 'Authentication Bypass' tag; this is a horizontal access-control bug where an already-authenticated user retrieves resources they should not, not a bypass of the login/auth boundary itself. Net: a genuine defect worth patching for affected deployments, but low real-world urgency given authentication is required, impact is confidentiality-only, and the product footprint is small. |
| Exploit ScenarioDerived | An attacker who holds a valid low-privilege account on a grimmory (self-hosted ebook/Kobo-sync) instance sends a request to the Kobo download endpoint while substituting another user's bookId value. Because streamFileToResponse does not verify that the requesting user is authorized for that bookId, the server streams the arbitrary book file back. A public POC is referenced via the VulDB entry and the linked GitHub issue #2431. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
An authenticated low-privilege user of the Grimmory (BookLore) self-hosted library service can read book files belonging to other accounts by tampering with the bookId argument passed to the Kobo download endpoint handled by KoboController.streamFileToResponse, an IDOR-style authorization bypass (CWE-639) rated CVSS 5.3 with confidentiality-only impact. Publicly available exploit code exists, and although upstream issue #2431 is closed as completed, its only comment states the report 'has already been reported elsewhere' with no fixing commit or pull request identified there. No KEV listing or independent evidence of active exploitation was found, so real-world risk depends on whether the instance is network-reachable to an attacker who already holds valid credentials and whether the Kobo download feature is exposed.
RemediationAI
No vendor-released patch was identified at time of analysis: upstream issue #2431 is closed as completed, but its sole comment states the report 'has already been reported elsewhere' and no fixing commit, pull request, or tagged release is linked, so version 3.3.3/3.4.1 and earlier should be treated as vulnerable until a fixed release is published. Until a fix ships, the most effective compensating control is to add an ownership check in streamFileToResponse so that the requested bookId is validated against the authenticated user's library before any bytes are streamed, though this requires maintaining a local fork or patch and re-testing on every upstream update. If the Kobo sync/download feature is not required, disabling or removing that endpoint (including blocking its URL path at the reverse proxy) eliminates the exposure but breaks Kobo e-reader synchronization for legitimate users. Alternatively, restrict the Kobo endpoint to trusted network ranges or a VPN so that only verified clients can reach it, accepting the trade-off that remote Kobo devices outside that network will no longer sync, and where the application supports it, enable or verify audit logging on the download endpoint to detect enumeration of other users' bookId values. Because exploitation requires only a valid low-privilege account, tighten account provisioning and audit existing accounts for unauthorized or over-permissioned users, and monitor the VulDB record and the GitHub issue #2431 for a patched release before restoring unrestricted access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an object-reference authorization failure (CWE-639) in a Java/Spring-style HTTP controller, backend/src/main/java/org/booklore/controller/KoboController.java, method streamFileToResponse, which serves book content to Kobo e-reader clients. The bookId parameter is used directly to locate and stream a file without verifying that the authenticated caller owns or is entitled to that book, so changing the identifier returns another user's files. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P) confirms a network-reachable, low-complexity, unauthenticated-user-interaction-free attack that requires a valid low-privilege account (PR:L) and yields only limited confidentiality loss, with the E:P metric indicating a proof-of-concept exploit is publicly available; the independent assessment concurs with CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The affected-version CPE cpe:2.3:a:grimmory-tools:grimmory:*:*:*:*:*:*:*:* is a wildcard indicating all releases are presumed affected, and the description scopes the issue to Grimmory up to 3.3.3 and 3.4.1. No integrity or availability impact, privilege escalation beyond the already-held account, or scope change is indicated, so this is data exposure of library files rather than code execution or account takeover.
Know when Grimmory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable IDOR requiring a valid low-privilege account (PR:L, AC:L, UI:N); impact is reading arbitrary book files, so C:L with no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Stored XSS in Grimmory's browser-based EPUB reader (versions prior to 2.3.1) allows a low-privileged attacker who can ad
An incorrect authorization check in Grimmory (grimmory-tools/grimmory, published as BookLore) up to versions 3.3.3 and 3
Exploit-DB