CVE-2021-3987 — Improper Access Control in janeczku/calibre-web
An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnera…
Published: 2024-11-15 · CVSS: 5.4 · CVSS 3.0
An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7