CVE-2026-7713

crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization

State: Published
Severity: 5.3 Medium
Published: May 4, 2026
Updated: May 5, 2026
Reserved: May 3, 2026

Description

A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the file cps/kobo_auth.py of the component Kobo auth-token Route. The manipulation results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.0.7 addresses this issue. The patch is identified as 9f50bb2c16160564c9f8777dc2ceed3eb95e4807. The affected component should be upgraded.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
Calibre-Web-Automatedcrocodilestick	4.0.0Affected 4.0.1Affected 4.0.2Affected 4.0.3Affected 4.0.4Affected 4.0.5Affected 4.0.6Affected 4.0.7Not affected

References

VDB-360889 | crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorizationvdb-entrytechnical-description
VDB-360889 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #806403 | crocodilestick Calibre-Web-Automated v1.0.0-v4.0.6 IDOR in auth-token generation leading to account takeoverthird-party-advisory
https://github.com/crocodilestick/Calibre-Web-Automated/issues/1303issue-tracking
https://github.com/new-usemame/Calibre-Web-NextGen/pull/18issue-trackingpatch
https://gist.github.com/menelausx/ef98aa78ed2869ccaa316ff45ed1a440exploit
https://github.com/new-usemame/Calibre-Web-NextGen/commit/9f50bb2c16160564c9f8777dc2ceed3eb95e4807patch
https://github.com/new-usemame/Calibre-Web-NextGen/releases/tag/v4.0.7patch
https://github.com/crocodilestick/Calibre-Web-Automated/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.