CVE-2021-3987: Improper Access Control in janeczku/calibre-web

November 15, 2024

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the create_shelf method in shelf.py not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.

References

github.com/advisories/GHSA-fj5v-w2jp-wqvj
github.com/janeczku/calibre-web
github.com/janeczku/calibre-web/commit/bcdc97641447965af486964537f3821f47b28874
huntr.com/bounties/29fcc091-87b6-43bc-ab4b-3c0bec3f71df
nvd.nist.gov/vuln/detail/CVE-2021-3987

Code Behaviors & Features

Detect and mitigate CVE-2021-3987 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →