CVE-2021-3987: Improper Access Control in janeczku/calibre-web

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-11-15 · updated 2026-06-17
Weakness: CWE-284

Description

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.

Affected products

janeczku/calibre-web: before 0.6.15 — fixed in 0.6.15

How to fix

Upgrade to a fixed version: janeczku/calibre-web 0.6.15. Check the vendor advisory for mitigations.

References

https://github.com/janeczku/calibre-web/commit/bcdc97641447965af486964537f3821f47b28874
https://huntr.com/bounties/29fcc091-87b6-43bc-ab4b-3c0bec3f71df

Get alerted when CVE-2021-3987 or the next vulnerability affects your stack