CVE-2026-7713

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7713", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-03T07:59:45.943Z", "datePublished": "2026-05-04T00:00:32.992Z", "dateUpdated": "2026-05-05T19:00:28.901Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-04T00:00:32.992Z"}, "title": "crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "crocodilestick", "product": "Calibre-Web-Automated", "versions": [{"version": "4.0.0", "status": "affected"}, {"version": "4.0.1", "status": "affected"}, {"version": "4.0.2", "status": "affected"}, {"version": "4.0.3", "status": "affected"}, {"version": "4.0.4", "status": "affected"}, {"version": "4.0.5", "status": "affected"}, {"version": "4.0.6", "status": "affected"}, {"version": "4.0.7", "status": "unaffected"}], "modules": ["Kobo auth-token Route"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the file cps/kobo_auth.py of the component Kobo auth-token Route. The manipulation results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.0.7 addresses this issue. The patch is identified as 9f50bb2c16160564c9f8777dc2ceed3eb95e4807. The affected component should be upgraded."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-05-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-03T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-03T10:04:54.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "JasperX (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/360889", "name": "VDB-360889 | crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/360889/cti", "name": "VDB-360889 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/806403", "name": "Submit #806403 | crocodilestick Calibre-Web-Automated v1.0.0-v4.0.6 IDOR in auth-token generation leading to account takeover", "tags": ["third-party-advisory"]}, {"url": "https://github.com/crocodilestick/Calibre-Web-Automated/issues/1303", "tags": ["issue-tracking"]}, {"url": "https://github.com/new-usemame/Calibre-Web-NextGen/pull/18", "tags": ["issue-tracking", "patch"]}, {"url": "https://gist.github.com/menelausx/ef98aa78ed2869ccaa316ff45ed1a440", "tags": ["exploit"]}, {"url": "https://github.com/new-usemame/Calibre-Web-NextGen/commit/9f50bb2c16160564c9f8777dc2ceed3eb95e4807", "tags": ["patch"]}, {"url": "https://github.com/new-usemame/Calibre-Web-NextGen/releases/tag/v4.0.7", "tags": ["patch"]}, {"url": "https://github.com/crocodilestick/Calibre-Web-Automated/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-05T18:59:56.662709Z", "id": "CVE-2026-7713", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T19:00:28.901Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7713", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-05T18:59:56.662709Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T19:00:20.287Z"}}], "cna": {"tags": ["x_open-source"], "title": "crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization", "credits": [{"lang": "en", "type": "reporter", "value": "JasperX (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "crocodilestick", "modules": ["Kobo auth-token Route"], "product": "Calibre-Web-Automated", "versions": [{"status": "affected", "version": "4.0.0"}, {"status": "affected", "version": "4.0.1"}, {"status": "affected", "version": "4.0.2"}, {"status": "affected", "version": "4.0.3"}, {"status": "affected", "version": "4.0.4"}, {"status": "affected", "version": "4.0.5"}, {"status": "affected", "version": "4.0.6"}, {"status": "unaffected", "version": "4.0.7"}]}], "timeline": [{"lang": "en", "time": "2026-05-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-03T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-03T10:04:54.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/360889", "name": "VDB-360889 | crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/360889/cti", "name": "VDB-360889 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/806403", "name": "Submit #806403 | crocodilestick Calibre-Web-Automated v1.0.0-v4.0.6 IDOR in auth-token generation leading to account takeover", "tags": ["third-party-advisory"]}, {"url": "https://github.com/crocodilestick/Calibre-Web-Automated/issues/1303", "tags": ["issue-tracking"]}, {"url": "https://github.com/new-usemame/Calibre-Web-NextGen/pull/18", "tags": ["issue-tracking", "patch"]}, {"url": "https://gist.github.com/menelausx/ef98aa78ed2869ccaa316ff45ed1a440", "tags": ["exploit"]}, {"url": "https://github.com/new-usemame/Calibre-Web-NextGen/commit/9f50bb2c16160564c9f8777dc2ceed3eb95e4807", "tags": ["patch"]}, {"url": "https://github.com/new-usemame/Calibre-Web-NextGen/releases/tag/v4.0.7", "tags": ["patch"]}, {"url": "https://github.com/crocodilestick/Calibre-Web-Automated/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the file cps/kobo_auth.py of the component Kobo auth-token Route. The manipulation results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.0.7 addresses this issue. The patch is identified as 9f50bb2c16160564c9f8777dc2ceed3eb95e4807. The affected component should be upgraded."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-04T00:00:32.992Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7713", "state": "PUBLISHED", "dateUpdated": "2026-05-05T19:00:28.901Z", "dateReserved": "2026-05-03T07:59:45.943Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-04T00:00:32.992Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Kobo auth-token Route"], "product": "Calibre-Web-Automated", "vendor": "crocodilestick", "versions": [{"status": "affected", "version": "4.0.0"}, {"status": "affected", "version": "4.0.1"}, {"status": "affected", "version": "4.0.2"}, {"status": "affected", "version": "4.0.3"}, {"status": "affected", "version": "4.0.4"}, {"status": "affected", "version": "4.0.5"}, {"status": "affected", "version": "4.0.6"}, {"status": "unaffected", "version": "4.0.7"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the file cps/kobo_auth.py of the component Kobo auth-token Route. The manipulation results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.0.7 addresses this issue. The patch is identified as 9f50bb2c16160564c9f8777dc2ceed3eb95e4807. The affected component should be upgraded."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en crocodilestick Calibre-Web-Automated hasta la versi\u00f3n 4.0.6. Afectada por esta vulnerabilidad es la funci\u00f3n generate_auth_token del archivo cps/kobo_auth.py del componente Kobo auth-token Route. La manipulaci\u00f3n resulta en una autorizaci\u00f3n indebida. El ataque puede ser realizado de forma remota. El exploit es ahora p\u00fablico y puede ser utilizado. La actualizaci\u00f3n a la versi\u00f3n 4.0.7 aborda este problema. El parche se identifica como 9f50bb2c16160564c9f8777dc2ceed3eb95e4807. El componente afectado deber\u00eda ser actualizado."}], "id": "CVE-2026-7713", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7713", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-05T18:59:56.662709Z", "version": "2.0.3"}}]}, "published": "2026-05-04T00:16:40.167", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/menelausx/ef98aa78ed2869ccaa316ff45ed1a440"}, {"source": "cna@vuldb.com", "url": "https://github.com/crocodilestick/Calibre-Web-Automated/"}, {"source": "cna@vuldb.com", "url": "https://github.com/crocodilestick/Calibre-Web-Automated/issues/1303"}, {"source": "cna@vuldb.com", "url": "https://github.com/new-usemame/Calibre-Web-NextGen/commit/9f50bb2c16160564c9f8777dc2ceed3eb95e4807"}, {"source": "cna@vuldb.com", "url": "https://github.com/new-usemame/Calibre-Web-NextGen/pull/18"}, {"source": "cna@vuldb.com", "url": "https://github.com/new-usemame/Calibre-Web-NextGen/releases/tag/v4.0.7"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/806403"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360889"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360889/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.0.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Calibre-Web-Automated", "source": "cna", "vendor": "crocodilestick"}, "product": "calibre-web-automated", "vendor": "crocodilestick"}], "created": "2026-05-04T01:30:33.818413+00:00", "updated": "2026-05-04T16:06:20.528239+00:00", "vendors": ["crocodilestick", "crocodilestick$PRODUCT$calibre-web-automated"]}