PT-2026-38908 · Kareadita · Kavita

Kevin Stubbings + 1 · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-44775

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Kavita versions prior to 0.9.0

Description The ReaderController.GetImage endpoint is decorated with [AllowAnonymous], which permits unauthenticated access to page images from any chapter in any library. Although the endpoint accepts an apiKey parameter, it is not validated. Because entity IDs are sequential integers, an attacker can enumerate all content on the server.

Recommendations Update to version 0.9.0.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-44775

Affected Products

Kavita

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-44775 · Security Note
• https://github.com/Kareadita/Kavita/security/advisories/GHSA-6gc9-6r8p-5wg2 · Note
• https://github.com/Kareadita/Kavita/blob/8c686df2dbc2d0a83120e8b3f8c1269107bb815d/API/Controllers/ReaderController.cs#L116 · Note
• https://reddit.com/r/selfhosted/comments/1t75mtc/kavita_v090_release_and_cve_update_notice · Reddit Post
• https://twitter.com/CVEnew/status/2059337164802986406 · Twitter Post