Audiobookshelf before version 2.32.2 contains an incorrect authorization vulnerability (CWE-863) in the GET /api/libraries/:id/download endpoint. While the endpoint checks that the user has access to the specified library ID in the URL path, it fetches downloadable items based solely on attacker-supplied item IDs without verifying that those items belong to the authorized library. Consequently, an authenticated user with download permissions for any single library can exfiltrate files from other libraries they are not authorized to access. This issue is resolved in version 2.32.2.

An attacker with valid authentication and download permissions on any one library can bypass intended access controls to download files from other libraries they are explicitly denied access to. This leads to unauthorized disclosure of audiobook content. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Upgrade audiobookshelf to version 2.32.2 or later, where this authorization flaw is fixed. Since this is a self-hosted product, administrators must apply the update manually. Patch status is confirmed fixed in 2.32.2. No other mitigations are indicated.