CVE-2026-42884

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collections and GET /api/collections/:id endpoints return collections from all libraries without checking whether the requesting user has access to each collection's library. An authenticated user with access to any library can enumerate and read collections (including full book metadata) from libraries they are explicitly restricted from accessing. This vulnerability is fixed in 2.32.2.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rxw2-h55w-ffmh
https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rxw2-h55w-ffmh

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Audiobookshelf es un servidor de audiolibros y podcasts autoalojado. Antes de la versión 2.32.2, los endpoints GET /api/collections y GET /api/collections/:id devuelven colecciones de todas las bibliotecas sin verificar si el usuario solicitante tiene acceso a la biblioteca de cada colección. Un usuario autenticado con acceso a cualquier biblioteca puede enumerar y leer colecciones (incluyendo metadatos completos de libros) de bibliotecas a las que se les ha restringido explícitamente el acceso. Esta vulnerabilidad se ha corregido en la versión 2.32.2.

Information

Published : 2026-05-11 20:25

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42884

Mitre link : CVE-2026-42884

CVE.ORG link : CVE-2026-42884

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-42884", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42884", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:24:41.236492Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "advplyr", "product": "audiobookshelf", "versions": [{"status": "affected", "version": "< 2.33.2"}]}]}], "published": "2026-05-11T20:25:44.740", "references": [{"url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rxw2-h55w-ffmh", "source": "security-advisories@github.com"}, {"url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rxw2-h55w-ffmh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collections and GET /api/collections/:id endpoints return collections from all libraries without checking whether the requesting user has access to each collection's library. An authenticated user with access to any library can enumerate and read collections (including full book metadata) from libraries they are explicitly restricted from accessing. This vulnerability is fixed in 2.32.2."}, {"lang": "es", "value": "Audiobookshelf es un servidor de audiolibros y podcasts autoalojado. Antes de la versi\u00f3n 2.32.2, los endpoints GET /api/collections y GET /api/collections/:id devuelven colecciones de todas las bibliotecas sin verificar si el usuario solicitante tiene acceso a la biblioteca de cada colecci\u00f3n. Un usuario autenticado con acceso a cualquier biblioteca puede enumerar y leer colecciones (incluyendo metadatos completos de libros) de bibliotecas a las que se les ha restringido expl\u00edcitamente el acceso. Esta vulnerabilidad se ha corregido en la versi\u00f3n 2.32.2."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}