CVE-2026-57562

Received Received - Intake

Privilege Escalation in Readest Ebook Reader

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-57562

Affected Vendors & Products

Vendor	Product	Version / Range
readest	readest	< 0.11.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Readest is an ebook reader app. Before version 0.11.10, an API endpoint /api/stripe/check allowed authenticated users to provide a session ID from a Stripe Checkout Session. The app would grant a paid plan to the authenticated user without verifying if the session belonged to them. This let any free user reuse a valid session ID from another user's purchase to upgrade their own account without paying.

Detection Guidance

Detecting this vulnerability requires checking if your Readest application version is below 0.11.10. Verify the installed version by inspecting package.json or running commands like npm list readest or checking the application's version in the admin panel or logs.

Impact Analysis

If you use Readest before version 0.11.10, someone could exploit this to upgrade their free account to a paid plan without paying by reusing a valid Stripe session ID from another user's purchase. This could lead to unauthorized access to premium features.

Mitigation Strategies

Immediately upgrade Readest to version 0.11.10 or later to patch the vulnerability. Review user accounts for unauthorized plan upgrades and revoke any illegitimate access. Audit Stripe Checkout Session metadata to ensure userId alignment with authenticated callers.

Hi! I’m here to help you understand CVE-2026-57562. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...