CVE-2026-44776: Kavita Authorization Bypass Vulnerability

CVE-2026-44776 Overview

Kavita is a cross-platform reading server used to organize and stream digital comics, manga, and books. CVE-2026-44776 is a broken access control vulnerability in Kavita versions prior to 0.9.0. The download, size-check, and chapter metadata endpoints fail to enforce library-level authorization. A low-privileged authenticated user who knows or guesses a chapterId, volumeId, or seriesId belonging to a library they are not assigned to can download file contents, query file sizes, and read metadata. The vulnerability is classified under [CWE-639] Authorization Bypass Through User-Controlled Key. It is fixed in Kavita 0.9.0.

Critical Impact
Authenticated users can access content from libraries outside their authorized scope by enumerating numeric identifiers, exposing restricted reading material and metadata.

Affected Products

Kavita reading server versions prior to 0.9.0
/api/Download/* endpoints (volume, chapter, series, and their size variants)
/api/Chapter metadata endpoint

Discovery Timeline

2026-05-26 - CVE-2026-44776 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-44776

Vulnerability Analysis

The vulnerability stems from missing authorization checks on resource-access endpoints in Kavita. While the application authenticates users, it does not verify whether the authenticated user has been granted access to the specific library containing the requested resource. The affected endpoints include /api/Download/volume-size, /api/Download/chapter-size, /api/Download/series-size, /api/Download/volume, /api/Download/chapter, /api/Download/series, and /api/Chapter. Each accepts a numeric identifier as input and returns data without confirming library membership.

Exploitation requires only valid low-privileged credentials. An attacker iterates through numeric chapterId, volumeId, or seriesId values and issues GET requests to the vulnerable endpoints. The server responds with full file contents, size information, or metadata regardless of the user's library assignment.

Root Cause

The root cause is an Insecure Direct Object Reference (IDOR) pattern. Endpoint handlers retrieve and return resources based solely on the supplied identifier. They omit the cross-check between the resource's parent library and the requesting user's library access list. This is consistent with [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

The attack vector is network-based and requires authentication. An adversary with any user account on a Kavita instance can enumerate identifiers via incrementing integers. Each request to a vulnerable endpoint that resolves to a valid resource returns content the user should not access. Refer to the GitHub Security Advisory GHSA-x3jq-95xw-gwvr for vendor technical details.

Detection Methods for CVE-2026-44776

Indicators of Compromise

Sequential or enumerated requests from a single authenticated user to /api/Download/chapter, /api/Download/volume, or /api/Download/series endpoints with varying numeric identifiers
High volume of /api/Download/*-size requests originating from accounts that historically access only a narrow set of libraries
Successful HTTP 200 responses on /api/Chapter requests for identifiers not associated with the user's assigned libraries

Detection Strategies

Correlate authenticated user identities with the library IDs of the resources they request and flag mismatches
Apply rate-limiting and anomaly detection to download endpoints to surface enumeration patterns
Review application logs for users issuing requests against a wide spread of chapterId, volumeId, or seriesId values within short time windows

Monitoring Recommendations

Forward Kavita reverse-proxy and application logs to a centralized log platform for retention and query
Alert on download volumes per user that exceed historical baselines
Monitor for new accounts followed by rapid access attempts across multiple libraries

How to Mitigate CVE-2026-44776

Immediate Actions Required

Upgrade all Kavita deployments to version 0.9.0 or later, which contains the authorization fix
Audit user accounts and remove any unnecessary or stale low-privileged users that could be leveraged for enumeration
Review download and access logs from before the upgrade to identify potential prior unauthorized access

Patch Information

The vulnerability is fixed in Kavita 0.9.0. The patch enforces library-level authorization on the affected /api/Download/* and /api/Chapter endpoints. Release notes and patch details are available in the GitHub Security Advisory GHSA-x3jq-95xw-gwvr.

Workarounds

Restrict network exposure of the Kavita instance to trusted networks or VPN-only access until patching is complete
Disable or remove low-privileged user accounts that do not require active access during the patch window
Place the Kavita API behind a reverse proxy that enforces request rate limits on /api/Download/* paths

bash

# Configuration example: nginx rate limit on Kavita download endpoints
limit_req_zone $binary_remote_addr zone=kavita_dl:10m rate=10r/m;

location /api/Download/ {
    limit_req zone=kavita_dl burst=5 nodelay;
    proxy_pass http://kavita_backend;
}