PT-2026-39749 · Advplyr · Audiobookshelf

Bugbunny-Research · Publicado 2026-05-11 · Atualizado 2026-05-11 · CVE-2026-42884

NVD

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collections and GET /api/collections/:id endpoints return collections from all libraries without checking whether the requesting user has access to each collection's library. An authenticated user with access to any library can enumerate and read collections (including full book metadata) from libraries they are explicitly restricted from accessing. This vulnerability is fixed in 2.32.2.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-42884

Produtos afetados

Audiobookshelf

Referências · 2

• https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rxw2-h55w-ffmh · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42884 · Nota de Segurança