CVE-2021-25965: Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF)

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-16 · updated 2026-06-17
Weakness: CWE-352

Description

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application.

Affected products

janeczku/calibre-web: from 0.6.0 through 0.6.13

References

https://github.com/janeczku/calibre-web/commit/50919d47212066c75f03ee7a5332ecf2d584b98e
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25965
https://github.com/janeczku/calibre-web/commit/50919d47212066c75f03ee7a5332ecf2d584b98e
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25965

Get alerted when CVE-2021-25965 or the next vulnerability affects your stack