CVE-2026-44775: Kavita Auth Bypass Vulnerability

CVE-2026-44775 Overview

CVE-2026-44775 affects Kavita, a cross-platform reading server used to host digital libraries of books and comics. Versions prior to 0.9.0 expose the ReaderController.GetImage endpoint with an [AllowAnonymous] decorator, permitting unauthenticated access to page images from any chapter in any library. The endpoint accepts an apiKey parameter but never validates it. Because entity IDs are sequential integers, an attacker can enumerate and download all hosted content without credentials. The vulnerability is classified as Missing Authentication for Critical Function [CWE-306] and is fixed in Kavita 0.9.0.

Critical Impact
Unauthenticated remote attackers can enumerate sequential chapter IDs and exfiltrate page images from every library hosted on a Kavita server.

Affected Products

Kavita reading server versions prior to 0.9.0
ReaderController.GetImage endpoint in the Kavita API
Any Kavita deployment exposing its API to untrusted networks

Discovery Timeline

2026-05-26 - CVE-2026-44775 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-44775

Vulnerability Analysis

The flaw resides in Kavita's ReaderController.GetImage action, which serves page images for chapters in user libraries. The controller method is decorated with the [AllowAnonymous] attribute, overriding the default authentication requirement applied to the rest of the API. The endpoint receives an apiKey query parameter but the implementation never compares it against any stored user key. As a result, any caller reaching the endpoint over the network can retrieve image data regardless of authentication state.

Kavita assigns chapter, volume, and series identifiers as sequential integers in its database. An attacker who can reach the endpoint can iterate identifiers from 1 upward and pull every page image hosted by the server. This converts a single missing access control check into a full content-exfiltration channel covering private libraries.

Root Cause

The root cause is a missing authorization check on a sensitive content endpoint. The [AllowAnonymous] attribute combined with an unvalidated apiKey parameter creates the appearance of access control without enforcing one. Sequential integer identifiers compound the issue by removing any need for the attacker to guess opaque tokens.

Attack Vector

Exploitation requires only network access to the Kavita HTTP API. An attacker sends repeated GET requests to the GetImage endpoint, incrementing the chapter and page identifiers in each request. No credentials, user interaction, or prior authentication are required. The technical references include the GitHub Security Advisory GHSA-6gc9-6r8p-5wg2 and the GitHub Kavita Code Review showing the affected controller.

No verified public exploit code is available; the vulnerability mechanism is straightforward HTTP enumeration against the unauthenticated endpoint.

Detection Methods for CVE-2026-44775

Indicators of Compromise

Sequential GET requests to /api/Reader/image or similar ReaderController.GetImage routes from a single client IP
High-volume requests iterating chapterId, volumeId, or page parameters in numeric order
Requests to the image endpoint with missing, malformed, or repeated apiKey values
Successful 200 responses to the image endpoint without preceding authentication traffic from the same source

Detection Strategies

Inspect Kavita web server logs for clients hitting the image endpoint without an authenticated session
Correlate request rate and identifier patterns to flag enumeration behavior against ReaderController routes
Alert when traffic to the image endpoint originates from networks outside the expected user base

Monitoring Recommendations

Forward Kavita access logs to a centralized logging platform for retention and query
Track request volume per source IP against image endpoints and set thresholds for sustained enumeration
Monitor for outbound bandwidth spikes from the Kavita host that could indicate bulk content download

How to Mitigate CVE-2026-44775

Immediate Actions Required

Upgrade Kavita to version 0.9.0 or later, which removes the [AllowAnonymous] decorator and enforces authentication on ReaderController.GetImage
Restrict Kavita exposure so the API is reachable only from trusted networks or through a reverse proxy that enforces authentication
Review web server logs for prior enumeration activity against the image endpoint

Patch Information

The Kavita maintainers fixed CVE-2026-44775 in version 0.9.0. The fix removes anonymous access from ReaderController.GetImage and requires the request to be authenticated. Patch details are documented in GitHub Security Advisory GHSA-6gc9-6r8p-5wg2.

Workarounds

Place Kavita behind a reverse proxy that requires authentication before forwarding requests to the image endpoint
Restrict inbound access to the Kavita port using host or network firewall rules until the upgrade is applied
Disable public exposure of the Kavita instance and require VPN access for remote users

bash

# Example nginx snippet restricting access to the Kavita image endpoint
location /api/Reader/image {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://127.0.0.1:5000;
}