Audiobookshelf versions before 2.32.2 contain an incorrect authorization vulnerability (CWE-863) in the GET /api/libraries/:id/download endpoint. While the endpoint checks if the user has access to the library specified in the URL path, it retrieves downloadable items solely based on attacker-controlled IDs without verifying that these items belong to the authorized library. Consequently, an authenticated user with download permissions on any single library can download files from other libraries they are explicitly denied access to. This issue allows unauthorized data exfiltration across libraries within the same audiobookshelf instance. The vulnerability is resolved in version 2.32.2.

An attacker who is authenticated and has download permission on any one library can bypass authorization controls to access and exfiltrate files from other libraries they do not have permission to access. This leads to unauthorized disclosure of potentially sensitive audiobook or podcast content. The vulnerability does not affect integrity or availability but compromises confidentiality. There are no known exploits in the wild at this time.

This vulnerability is fixed in audiobookshelf version 2.32.2. Users should upgrade to version 2.32.2 or later to remediate this issue. Since this is a self-hosted product, administrators must apply the update manually. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 2.32.2. Until upgraded, restrict download permissions carefully and monitor access to sensitive libraries.