PT-2026-22385 · Calibre · Calibre

Dxleryt · Published 2026-01-01 · Updated 2026-04-21 · CVE-2026-27824

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions calibre versions prior to 9.4.0

Description calibre is an e-book manager used for viewing, converting, editing, and cataloging e-books. The Content Server’s brute-force protection mechanism relies on a ban key derived from both the remote addr and the X-Forwarded-For header. The X-Forwarded-For header is directly read from HTTP requests without validation or trusted-proxy configuration. This allows attackers to bypass IP-based bans by modifying or adding to the X-Forwarded-For header, effectively disabling the brute-force protection. This poses a risk to servers exposed to the internet, as brute-force protection is a primary defense against credential stuffing and password guessing attacks.

Recommendations Update to calibre version 9.4.0 or later.

Exploit

Fix

Origin Validation Error

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-346

CWE-307

Related Identifiers

CVE-2026-27824

GHSA-VHXC-R7V8-2XRW

OPENSUSE-SU-2026:10587-1

Affected Products

Calibre

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27824.json · Exploit
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vhxc-r7v8-2xrw · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27824 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10587-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27824 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27824 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27824 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27824 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27824 · Security Note
• https://suse.com/security/cve/CVE-2026-33205 · Note
• https://suse.com/security/cve/CVE-2026-25635 · Note
• https://suse.com/security/cve/CVE-2026-26064 · Note
• https://suse.com/security/cve/CVE-2026-25731 · Note
• https://suse.com/security/cve/CVE-2026-27824 · Note