Improper Access Control

2022-04-0412:20:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

calibreweb

vulnerability

access control

rendering

html

server

user permissions

private shelves

EPSS

0.001

Percentile

21.4%

JSON

calibreweb is vulnerable to improper access control. The vulnerability exists because the server doesn’t properly validate the user permissions when rendering HTML containing shelf name which allows an attacker to gain access to names of all private shelves.