CVE-2026-7714 Details
Description
A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file cps/cwa_functions.py of the component Admin Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
A missing authentication vulnerability has been identified in Crocodilestick Calibre-Web-Automated versions through 4.0.6. The issue resides in the Admin Endpoint, specifically within the file 'cps/cwa_functions.py'. This vulnerability allows remote attackers to trigger bulk processing operations on the entire library, such as converting files to EPUB format or rewriting existing EPUBs, which can lead to significant resource exhaustion and storage issues.
Users are advised to update to the latest version of Calibre-Web-Automated, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 4, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/menelausx/1b45c952d352a2ebdc01cd8d5aa88e87 | [email protected] | ExploitTechnical Description |
| https://github.com/crocodilestick/Calibre-Web-Automated/ | [email protected] | Source CodeVendor |
| https://github.com/crocodilestick/Calibre-Web-Automated/issues/1304 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/crocodilestick/Calibre-Web-Automated/pull/1308 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/submit/806468 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360890 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360890/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| crocodilestick Calibre-Web-Automated | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |