CVE-2026-44776 is an authorization bypass vulnerability (CWE-639) in Kavita, a cross-platform reading server. Before version 0.9.0, the API endpoints for downloading content and querying size or metadata do not enforce library-level authorization checks. This allows a user with low privileges who can guess or know valid chapterId, volumeId, or seriesId values to access content and metadata from libraries they are not authorized to access. Affected endpoints include /api/Download/volume-size, /api/Download/chapter-size, /api/Download/series-size, /api/Download/volume, /api/Download/chapter, /api/Download/series, and /api/Chapter. The issue is resolved in version 0.9.0.

An attacker with low privileges can bypass authorization controls to download full file contents, query file sizes, and read metadata from libraries they should not have access to. This exposure can lead to unauthorized data disclosure. There is no indication of remote code execution or service disruption. The CVSS 4.0 score is 5.9, indicating medium severity.

Upgrade Kavita to version 0.9.0 or later, where this authorization bypass vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated but the vendor has fixed the issue in version 0.9.0.