CVE-2026-73249

Received Received - Intake

Calibre Content Server Annotation Write Access Bypass

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73249

Affected Vendors & Products

Vendor	Product	Version / Range
calibre	calibre	to 9.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The vulnerability in calibre before version 9.12.0 allows an attacker to modify book annotations without proper authorization. The issue occurs in the Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt}, where a missing parameter causes the system to skip a critical access check. This enables readonly or anonymous users to persist unauthorized changes to book annotations.

Detection Guidance

To detect this vulnerability, check if your calibre server version is below 9.12.0. If so, it is vulnerable. No specific commands are provided in the context to detect exploitation, but monitoring for unauthorized annotation changes in book metadata may indicate compromise.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to alter book annotations, potentially leading to misinformation or data integrity issues. Attackers might modify annotations to include misleading content or remove important notes, affecting the usability and reliability of the e-book collection.

Compliance Impact

This vulnerability could impact compliance with data integrity and access control requirements in GDPR and HIPAA. Unauthorized modifications to annotations may violate record-keeping or audit trail integrity, potentially leading to non-compliance with data protection and confidentiality standards.

Mitigation Strategies

Upgrade calibre to version 9.12.0 or later to address the vulnerability. Ensure the Content Server endpoint POST /book-update-annotations is properly secured with authentication and authorization checks.

Hi! I’m here to help you understand CVE-2026-73249. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70