CVE-2021-3987
CVE-2021-3987 · Improper Access Control in janeczku/calibre-web
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.
CVSS 5.4 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
janeczku/calibre-web
- Versions
- ≥ unspecified, ≤ latest: Affected (custom)
No fix published
calibreweb PyPI
- Versions
- 0.6.12
- 0.6.13
- 0.6.14
- Affected ranges
- ECOSYSTEM: < 0.6.15
Update to 0.6.15