PT-2026-38908 · Kavita · Kavita

Kevin Stubbings + 1 · CVE-2026-44775 · Published 2026-05-08 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Kavita versions prior to 0.9.0

Description The ReaderController.GetImage endpoint is decorated with [AllowAnonymous], which permits unauthenticated access to page images from any chapter in any library. Although the endpoint accepts an apiKey parameter, it is not validated. Because entity IDs are sequential integers, an attacker can enumerate all content on the server.

Recommendations Update to version 0.9.0.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-44775

GHSA-6GC9-6R8P-5WG2

Affected Products

Kavita

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44775.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-44775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44775 · Security Note
• https://github.com/Kareadita/Kavita/security/advisories/GHSA-6gc9-6r8p-5wg2 · Note
• https://github.com/Kareadita/Kavita/blob/8c686df2dbc2d0a83120e8b3f8c1269107bb815d/API/Controllers/ReaderController.cs#L116 · Note
• https://reddit.com/r/selfhosted/comments/1t75mtc/kavita_v090_release_and_cve_update_notice · Reddit Post
• https://twitter.com/CVEnew/status/2059337164802986406 · Twitter Post