CVE-2026-73249: CWE-862: Missing Authorization in kovidgoyal calibre
A missing authorization vulnerability in calibre prior to version 9.12.0 allows unauthorized users to persist changes to book annotations via the Content Server endpoint. This occurs because the endpoint omits a required database write access check, enabling read-only or anonymous users to modify annotations without proper permissions. The issue is fixed in version 9.12.0.
AI Analysis
Technical Summary
calibre versions before 9.12.0 have a missing authorization check in the Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt}. The endpoint omits the needs_db_write=True flag, causing Router.dispatch() to skip the ctx.check_for_write_access() call. As a result, update_annotations() accepts attacker-controlled JSON and passes it to db.merge_annotations_for_book(), allowing unauthorized users, including read-only or anonymous users on unauthenticated deployments, to persist annotation changes. This vulnerability is tracked as CVE-2026-73249 and is classified under CWE-862 (Missing Authorization).
Potential Impact
Unauthorized users can modify book annotations in the calibre Content Server without proper write permissions. This could lead to integrity issues in the stored annotations, potentially misleading users or corrupting data. There is no impact on confidentiality or availability reported.
Mitigation Recommendations
This vulnerability is fixed in calibre version 9.12.0. Users should upgrade to version 9.12.0 or later to remediate this issue. No vendor advisory is provided, so patch status is inferred from the description stating the fix is in 9.12.0.
CVE-2026-73249: CWE-862: Missing Authorization in kovidgoyal calibre
Description
A missing authorization vulnerability in calibre prior to version 9.12.0 allows unauthorized users to persist changes to book annotations via the Content Server endpoint. This occurs because the endpoint omits a required database write access check, enabling read-only or anonymous users to modify annotations without proper permissions. The issue is fixed in version 9.12.0.
CVSS v3.1
Score 7.5high
Affected software
pkg:github/kovidgoyal/calibreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
calibre versions before 9.12.0 have a missing authorization check in the Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt}. The endpoint omits the needs_db_write=True flag, causing Router.dispatch() to skip the ctx.check_for_write_access() call. As a result, update_annotations() accepts attacker-controlled JSON and passes it to db.merge_annotations_for_book(), allowing unauthorized users, including read-only or anonymous users on unauthenticated deployments, to persist annotation changes. This vulnerability is tracked as CVE-2026-73249 and is classified under CWE-862 (Missing Authorization).
Potential Impact
Unauthorized users can modify book annotations in the calibre Content Server without proper write permissions. This could lead to integrity issues in the stored annotations, potentially misleading users or corrupting data. There is no impact on confidentiality or availability reported.
Mitigation Recommendations
This vulnerability is fixed in calibre version 9.12.0. Users should upgrade to version 9.12.0 or later to remediate this issue. No vendor advisory is provided, so patch status is inferred from the description stating the fix is in 9.12.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-11T17:18:01.597Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7b9e69bf8831d5397e8737
Added to database: 08/11/2026, 22:12:57 UTC
Last enriched: 08/11/2026, 22:26:05 UTC
Last updated: 08/12/2026, 02:01:11 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.