CVE-2026-73249: CWE-862: Missing Authorization in kovidgoyal calibre
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
AI Analysis
Technical Summary
calibre versions before 9.12.0 have a missing authorization check in the Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt}. The endpoint omits the needs_db_write=True flag, causing Router.dispatch() to skip the ctx.check_for_write_access() call. As a result, update_annotations() accepts attacker-controlled JSON and passes it to db.merge_annotations_for_book(), allowing unauthorized users, including read-only or anonymous users on unauthenticated deployments, to persist annotation changes. This vulnerability is tracked as CVE-2026-73249 and is classified under CWE-862 (Missing Authorization).
Potential Impact
Unauthorized users can modify book annotations in the calibre Content Server without proper write permissions. This could lead to integrity issues in the stored annotations, potentially misleading users or corrupting data. There is no impact on confidentiality or availability reported.
Mitigation Recommendations
This vulnerability is fixed in calibre version 9.12.0. Users should upgrade to version 9.12.0 or later to remediate this issue. No vendor advisory is provided, so patch status is inferred from the description stating the fix is in 9.12.0.
CVE-2026-73249: CWE-862: Missing Authorization in kovidgoyal calibre
Description
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
CVSS v3.1
Score 7.5high
Affected software
kovidgoyal
calibre
pkg:github/kovidgoyal/calibreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
calibre versions before 9.12.0 have a missing authorization check in the Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt}. The endpoint omits the needs_db_write=True flag, causing Router.dispatch() to skip the ctx.check_for_write_access() call. As a result, update_annotations() accepts attacker-controlled JSON and passes it to db.merge_annotations_for_book(), allowing unauthorized users, including read-only or anonymous users on unauthenticated deployments, to persist annotation changes. This vulnerability is tracked as CVE-2026-73249 and is classified under CWE-862 (Missing Authorization).
Potential Impact
Unauthorized users can modify book annotations in the calibre Content Server without proper write permissions. This could lead to integrity issues in the stored annotations, potentially misleading users or corrupting data. There is no impact on confidentiality or availability reported.
Mitigation Recommendations
This vulnerability is fixed in calibre version 9.12.0. Users should upgrade to version 9.12.0 or later to remediate this issue. No vendor advisory is provided, so patch status is inferred from the description stating the fix is in 9.12.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-11T17:18:01.597Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7b9e69bf8831d5397e8737
Added to database: 08/11/2026, 22:12:57 UTC
Last enriched: 08/11/2026, 22:26:05 UTC
Last updated: 09/25/2026, 17:38:18 UTC
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.