CVE-2026-7709
published 2026-05-03CVE-2026-7709: A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of…
PriorityP344medium6.3CVSS 3.1
AVNACLPRLUINSUCLILAL
EPSS
0.22%
12.3th percentile
A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of the component Endpoint. Such manipulation of the argument user_id leads to improper authorization. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
| janeczku | calibre-web | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6xgw-x2hr-63c2: A vulnerability was identified in janeczku Calibre-Web up to 0
ghsa_unreviewed·2026-05-04
CVE-2026-7709 [LOW] CWE-266 GHSA-6xgw-x2hr-63c2: A vulnerability was identified in janeczku Calibre-Web up to 0
A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of the component Endpoint. Such manipulation of the argument user_id leads to improper authorization. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB
janeczku Calibre-Web up to 0.6.26 Endpoint cps/kobo_auth.py generate_auth_token user_id improper authorization (EUVD-2026-26849)
vuldb·2026-05-03·CVSS 2.1
CVE-2026-7709 [LOW] janeczku Calibre-Web up to 0.6.26 Endpoint cps/kobo_auth.py generate_auth_token user_id improper authorization (EUVD-2026-26849)
A vulnerability was found in janeczku Calibre-Web up to 0.6.26. It has been declared as critical. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of the component Endpoint. Such manipulation of the argument user_id leads to improper authorization.
This vulnerability is traded as CVE-2026-7709. The attack may be launched remotely. Furthermore, there is an exploit available.
The vendor was contacted early about this disclosure but did not respond in any way.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-03
Published