CVE-2026-7713 Details

An improper authorization vulnerability has been identified in Crocodilestick Calibre-Web-Automated versions through 4.0.6. The issue resides in the Kobo auth-token generation function, specifically within the 'cps/kobo_auth.py' file. The vulnerability allows any authenticated user to generate or retrieve a Kobo authentication token for another user by supplying the victim's user ID. This token can then be used to access the victim's Kobo account through the Calibre-Web application, effectively impersonating them. The vulnerability is present in the '/kobo_auth/generate_auth_token/<int:user_id>' endpoint, which is only protected by a user login requirement, without verifying if the requested user ID belongs to the current user or if the requester has admin privileges.

Users can upgrade to Crocodilestick Calibre-Web-Automated version 4.0.7, which addresses this vulnerability by adding a check to ensure that only the user themselves or an admin can generate or delete auth tokens for a given user ID.