This vulnerability affects the generate_auth_token function in the cps/kobo_auth.py file of janeczku Calibre-Web up to version 0.6.26. Improper handling of the user_id argument leads to improper authorization, enabling remote attackers to exploit this flaw without user interaction or elevated privileges. The CVSS 4.0 base score is 5.3, indicating a medium severity impact. The vendor has not issued any advisory or patch, and no official remediation level is assigned. Exploit code is publicly available, increasing the risk of exploitation despite no known active exploitation in the wild.

Successful exploitation could allow an attacker to bypass authorization controls remotely, potentially gaining unauthorized access to resources or functionality within Calibre-Web. The medium CVSS score reflects limited impact or complexity but confirms a genuine security concern. No direct evidence of exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected service and applying compensating controls to limit exposure.