An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the create_shelf
method in shelf.py
not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.
{ "nvd_published_at": "2024-11-15T11:15:06Z", "cwe_ids": [ "CWE-284", "CWE-862" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-11-15T20:51:30Z" }