CVE-2026-73249 - calibre Content Server Vulnerability

CVE-2026-73249 - calibre Content Server Vulnerability

A critical vulnerability, identified as CVE-2026-73249, has been discovered in the calibre Content Server. This issue affects versions prior to 9.12.0. The vulnerability arises from the omission of needs_db_write=True in the endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt}. This flaw allows unauthorized users to modify book annotations without proper write access.

Key Details:

• Affected Product: calibre (versions < 9.12.0)
• Vulnerability Type: Missing Write Authorization Check
• CVSS V3.1 Score: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• CWE: CWE-862

This vulnerability enables a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized changes to book annotations. The issue has been resolved in version 9.12.0.

Important References:

• Commit Fix
• Release with Fix
• Security Advisory

For more details, you can read the complete article here. 🚀