PT-2026-36726 · Janeczku · Calibre-Web

Jasperx · Published 2026-05-03 · Updated 2026-05-04 · CVE-2026-7709

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions janeczku Calibre-Web versions prior to 0.6.27

Description Improper authorization occurs in the Endpoint component due to the manipulation of the user id argument within the generate auth token() function located in the cps/kobo auth.py file. This issue allows a remote attacker to bypass authorization mechanisms.

Recommendations As a temporary workaround, restrict access to the generate auth token() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-266

CWE-285

Related Identifiers

CVE-2026-7709

Affected Products

Calibre-Web

References · 9

• 🔥 https://drive.google.com/drive/folders/1rosrcfxcHrQM7_GOiBwzY_GnCfXoFuVR?usp=drive_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7709 · Security Note
• https://t.me/CVEtracker/52588 · Telegram Post
• https://twitter.com/CVEnew/status/2051084367800217686 · Twitter Post
• https://t.me/cveNotify/161954 · Telegram Post
• https://vuldb.com/vuln/360885/cti · Note
• https://vuldb.com/vuln/360885 · Note
• https://twitter.com/infoflowcloud/status/2051085772845978071 · Twitter Post
• https://vuldb.com/submit/805823 · Note