calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification
Published Aug 11, 2026
7.5
HIGHCVSS 3.1
EPSS 0.44%
Description
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
Affected products
-
- Version < 9.12.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Kovidgoyal | Calibre | n/a |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (4)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57015 Advisory
- https://github.com/kovidgoyal/calibre/commit/71295e8b62801e1ccecaa4fac47e6942f11cfe1e x_refsource_MISC
- https://github.com/kovidgoyal/calibre/releases/tag/v9.12.0 x_refsource_MISC
- https://github.com/kovidgoyal/calibre/security/advisories/GHSA-5x64-w63v-x2g6 exploitx_refsource_CONFIRM
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57015 | Advisory | |
| https://github.com/kovidgoyal/calibre/commit/71295e8b62801e1ccecaa4fac47e6942f11cfe1e | x_refsource_MISC | |
| https://github.com/kovidgoyal/calibre/releases/tag/v9.12.0 | x_refsource_MISC | |
| https://github.com/kovidgoyal/calibre/security/advisories/GHSA-5x64-w63v-x2g6 | exploitx_refsource_CONFIRM |
Change history (0)
No recorded changes yet.