CVE-2026-42884: Audiobookshelf Auth Bypass Vulnerability

CVE-2026-42884 Overview

CVE-2026-42884 is a broken access control vulnerability in Audiobookshelf, a self-hosted audiobook and podcast server. Versions prior to 2.32.2 fail to enforce per-library authorization on the GET /api/collections and GET /api/collections/:id endpoints. Any authenticated user with access to at least one library can enumerate collections and read full book metadata from libraries they are explicitly restricted from accessing. The flaw is categorized under CWE-863: Incorrect Authorization. Audiobookshelf version 2.32.2 contains the fix.

Critical Impact
Authenticated users can bypass library-level access restrictions to read collection contents and book metadata from libraries outside their assigned permissions.

Affected Products

Audiobookshelf versions prior to 2.32.2
GET /api/collections endpoint
GET /api/collections/:id endpoint

Discovery Timeline

2026-05-11 - CVE-2026-42884 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42884

Vulnerability Analysis

The vulnerability resides in Audiobookshelf's collections API. The application implements a multi-library model where administrators assign users to specific libraries. Library-level access control is intended to isolate content between user groups.

The GET /api/collections and GET /api/collections/:id handlers retrieve collections without filtering results based on the requesting user's library permissions. The endpoints return collection objects, including embedded book metadata, from every library on the server. An authenticated user holding access to any single library can therefore enumerate collections belonging to libraries they have not been granted.

This is a classic instance of broken function-level authorization. The authentication check confirms the user is logged in, but the authorization layer never validates the relationship between the user and the parent library of each returned collection. The result is horizontal information disclosure across tenant boundaries within the same Audiobookshelf instance.

Root Cause

The root cause is a missing authorization check in the collections controller. The query layer fetches collections without applying a library access filter derived from the user's session permissions. The vulnerable code paths return data before evaluating whether the user has rights to the parent library.

Attack Vector

Exploitation requires only a valid authenticated session with access to one library. The attacker issues an HTTP GET request to /api/collections to enumerate collection identifiers, then issues GET /api/collections/:id requests to retrieve detailed metadata for each collection. No additional privileges, user interaction, or special tooling are required. The vulnerability is network-exploitable wherever the Audiobookshelf web interface is reachable.

For technical details, see the GitHub Security Advisory GHSA-rxw2-h55w-ffmh.

Detection Methods for CVE-2026-42884

Indicators of Compromise

Authenticated requests to /api/collections originating from user accounts assigned to a limited subset of libraries.
High-volume sequential GET /api/collections/:id requests from a single session, indicating enumeration.
Access log entries showing successful 200 OK responses to collection endpoints from non-admin users.

Detection Strategies

Review Audiobookshelf access logs for GET /api/collections requests and correlate the requesting user's library assignments against the returned collection IDs.
Baseline normal API usage per user role and alert on deviations involving the collections endpoints.
Audit user activity around the time the server ran any version prior to 2.32.2 to identify potential historical exposure.

Monitoring Recommendations

Forward Audiobookshelf application and reverse proxy logs to a centralized logging platform for correlation and retention.
Track per-user request rates to /api/collections* endpoints and alert on unusual enumeration patterns.
Monitor for unauthorized account creation or privilege changes that could broaden the impact of this disclosure flaw.

How to Mitigate CVE-2026-42884

Immediate Actions Required

Upgrade Audiobookshelf to version 2.32.2 or later, which contains the authorization fix.
Inventory user accounts and confirm library assignments reflect intended access boundaries.
Rotate or invalidate sessions after upgrading to remove any cached authorization state.

Patch Information

The fix is included in Audiobookshelf version 2.32.2. The maintainers added the missing library access check to the collections endpoints so that responses are filtered against the requesting user's permitted libraries. Refer to the GitHub Security Advisory GHSA-rxw2-h55w-ffmh for the upstream fix details.

Workarounds

Restrict authenticated access to the Audiobookshelf instance to trusted users only until the patch is applied.
Place the application behind a reverse proxy that enforces additional authentication and blocks direct access to /api/collections and /api/collections/:id from non-administrative accounts.
Temporarily consolidate sensitive content into instances separated by deployment boundary rather than relying on per-library access control.

bash

# Example: block the affected endpoints for non-admin users at an NGINX reverse proxy
location ~ ^/api/collections {
    # Allow only requests carrying an admin session cookie or API token
    if ($http_x_user_role != "admin") {
        return 403;
    }
    proxy_pass http://audiobookshelf_upstream;
}