PT-2026-38909 · Kareadita · Kavita

Kevin Stubbings + 1 · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-44776

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kavita versions prior to 0.9.0

Description Lack of library-level authorization in the download, size-check, and chapter metadata endpoints allows a low-privileged user to access content from libraries they are not assigned to. By knowing or guessing the chapterId, volumeId, or seriesId, an attacker can download full file contents, query file sizes, and read metadata. The affected endpoints are '/api/Download/volume-size', '/api/Download/chapter-size', '/api/Download/series-size', '/api/Download/volume', '/api/Download/chapter', '/api/Download/series', and '/api/Chapter'.

Recommendations Update to version 0.9.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-44776

Affected Products

Kavita

References · 4

• 🔥 https://github.com/Kareadita/Kavita/security/advisories/GHSA-x3jq-95xw-gwvr · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44776 · Security Note
• https://reddit.com/r/selfhosted/comments/1t75mtc/kavita_v090_release_and_cve_update_notice · Reddit Post
• https://twitter.com/CVEnew/status/2059337163695632452 · Twitter Post