CVE-2026-7709: Calibre-Web Auth Bypass Vulnerability

CVE-2026-7709 Overview

CVE-2026-7709 is an improper authorization vulnerability in janeczku Calibre-Web through version 0.6.26. The flaw resides in the generate_auth_token function within cps/kobo_auth.py, where manipulation of the user_id argument leads to authorization bypass [CWE-266]. An authenticated remote attacker can abuse the endpoint to obtain authentication tokens scoped to other users. Public exploit details are available, and the maintainer did not respond to coordinated disclosure attempts. The issue affects deployments that expose the Kobo sync endpoint to authenticated users.

Critical Impact

Authenticated remote attackers can manipulate the user_id parameter to generate authentication tokens for other accounts, breaking the authorization boundary in the Kobo sync endpoint.

Affected Products

• janeczku Calibre-Web up to and including version 0.6.26
• Self-hosted Calibre-Web instances exposing the Kobo sync endpoint
• Deployments using cps/kobo_auth.py for Kobo eReader integration

Discovery Timeline

• 2026-05-03 - CVE-2026-7709 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7709

Vulnerability Analysis

Calibre-Web is an open-source web application that provides a browser interface to Calibre eBook libraries, including synchronization with Kobo eReaders. The Kobo integration uses an authentication token system implemented in cps/kobo_auth.py. The generate_auth_token function constructs tokens based on a user_id argument supplied through the request flow.

The vulnerability stems from missing authorization checks tying the supplied user_id to the currently authenticated session. An attacker with a low-privilege account can submit a user_id value belonging to another user and receive a valid token bound to that target identity. This pattern maps to CWE-266 (Incorrect Privilege Assignment), where an account is granted privileges it should not possess.

Root Cause

The root cause is a trust boundary failure inside generate_auth_token. The function accepts a caller-controlled identifier without validating that the identifier matches the session principal. Without that binding, the token generation routine treats any submitted user_id as authoritative and signs a token accordingly.

Attack Vector

Exploitation requires network access and a valid low-privilege Calibre-Web account. The attacker authenticates, then triggers the Kobo authentication flow while substituting another user's identifier in the user_id parameter. The server returns a token usable against Kobo sync endpoints for the impersonated account, exposing that user's library state and metadata. The exploit is publicly available according to the VulDB submission, increasing the likelihood of opportunistic abuse against internet-exposed instances.

The vulnerability does not allow unauthenticated access, and the impact on confidentiality, integrity, and availability is bounded to the targeted user's Kobo session context. There is no synthetic exploitation code referenced here; technical details are tracked in the VulDB Vulnerability #360885 entry.

Detection Methods for CVE-2026-7709

Indicators of Compromise

• Requests to Kobo authentication endpoints in cps/kobo_auth.py containing user_id values that do not match the session user.
• Multiple successful token generations for distinct user_id values originating from a single source IP or session.
• Anomalous Kobo sync activity associated with accounts that do not own a registered Kobo device.

Detection Strategies

• Enable verbose application logging in Calibre-Web and correlate the authenticated session user against the user_id argument observed in token generation calls.
• Deploy a web application firewall rule that inspects the Kobo authentication endpoint and flags mismatches between session cookies and supplied identifiers.
• Review historical access logs for repeated calls to the Kobo auth path from the same client targeting different user_id values.

Monitoring Recommendations

• Forward Calibre-Web access and application logs to a central analytics platform and alert on token generation events that span multiple user identifiers within a short window.
• Track authentication anomalies and lateral identity reuse patterns across self-hosted services exposed to the internet.

How to Mitigate CVE-2026-7709

Immediate Actions Required

• Restrict access to Calibre-Web instances behind a VPN or authenticated reverse proxy until a vendor patch is available.
• Audit existing user accounts for unauthorized Kobo tokens and revoke any tokens that cannot be tied to a legitimate session.
• Disable the Kobo sync feature in config.py if the deployment does not require Kobo eReader integration.

Patch Information

No official patch from the project maintainer has been published at the time of NVD disclosure. According to the CVE record, the vendor was contacted but did not respond. Operators should monitor the janeczku Calibre-Web project for upstream fixes and community forks that address the generate_auth_token authorization check.

Workarounds

• Apply network-level controls that limit the Kobo authentication endpoint to trusted clients only.
• Add a reverse proxy rule that rejects requests where the supplied user_id does not match the authenticated principal.
• Operate Calibre-Web in single-user mode where feasible, eliminating cross-user authorization boundaries.

# Example nginx restriction limiting the Kobo auth endpoint to an internal subnet
location /kobo/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://calibre_web_upstream;
}