janeczku/calibre-web · Security
Improper Access Control in janeczku/calibre-web
- GHSA ID
- GHSA-fj5v-w2jp-wqvj
- CVE ID
- CVE-2021-3987
- Severity
- medium
- Published
- Updated
- CVSS
- 5.4 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS v3
- 5.4 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description
An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the create_shelf method in shelf.py not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.
CWEs
- CWE-284 · Improper Access Control
- CWE-862 · Missing Authorization