CVE-2026-44776— Kavita: IDOR in /api/Download/*
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44776
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kavita: IDOR in /api/Download/*
Source: NVD (National Vulnerability Database)
Vulnerability Description
Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization. A low-privileged user who knows or guesses a chapterId, volumeId, or seriesId belonging to a library they are not assigned to can download the full file contents, query file sizes, and read metadata for that content. This affects /api/Download/volume-size, /api/Download/chapter-size, /api/Download/series-size, /api/Download/volume, /api/Download/chapter, /api/Download/series, and /api/Chapter. This vulnerability is fixed in 0.9.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44776
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44776
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44776 (1)
Same Patch Batch · Kareadita · 2026-05-26 · 3 CVEs total
| CVE-2026-47202 | Kavita: Pre-Auth Account Takeover | |
| CVE-2026-44775 | Kavita: No authentication at /api/Reader/image |
IV. Related Vulnerabilities
Same vendor: Kareadita
- CVE-2026-47202
Kavita: Pre-Auth Account Takeover - CVE-2026-44775
Kavita: No authentication at /api/Reader/image - CVE-2024-39307
Cross-Site Scripting (XSS) vulnerability via crafted ebooks - CVE-2023-0919
Missing Authentication for Critical Function in kareadita/ka - CVE-2022-3993
Improper Restriction of Excessive Authentication Attempts in
Same weakness: CWE-639
- CVE-2026-42725
WordPress Checkout Files Upload for WooCommerce plugin <= 2. - CVE-2026-42736
WordPress BP Better Messages plugin <= 2.14.16 - Insecure Di - CVE-2026-8890
code100x Mobile API Authentication Bypass via Header Spoofin - CVE-2026-47716
Bugsink: Issue bulk actions can affect another project’s iss - CVE-2026-47715
Bugsink: Issue event views can show an event from another pr
V. Comments for CVE-2026-44776
No comments yet