EUVD-2026-57015Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable with no prerequisites on unauthenticated deployments; integrity impact only as annotations are written, no confidentiality or availability effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
AnalysisAI
Missing authorization in calibre's Content Server allows readonly or anonymous users to persist unauthorized annotation changes to library books prior to version 9.12.0. The POST /book-update-annotations endpoint omits the needs_db_write=True decorator flag, causing the router to bypass ctx.check_for_write_access() and pass attacker-controlled JSON directly into the database via db.merge_annotations_for_book(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The calibre Content Server must be running and reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) reflects the worst case: an internet-exposed calibre Content Server with no password set, where any anonymous network actor can trigger the flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach an unauthenticated calibre Content Server over the network sends a crafted POST request to /book-update-annotations/{library_id}/{book_id}/{fmt} with a malicious JSON annotation payload. Because needs_db_write=True is absent, Router.dispatch() skips the write-access gate and db.merge_annotations_for_book() processes the payload, persisting unauthorized annotation changes. … |
| Remediation | Upgrade calibre to version 9.12.0 or later, which adds needs_db_write=True to the @endpoint decorator for /book-update-annotations, restoring proper write-access authorization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Content Server instances and identify those running versions prior to 9.12.0, particularly any internet-exposed deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today