CVE-2026-73249

calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

7.5 HighFix available

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.44%Up 0.2 points since Aug 12, 2026

What each source reports

CVE List Score used 7.5

calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

Record: CVE-2026-73249
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2026-57015 7.5

Record: EUVD-2026-57015
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-73249
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSV 7.5

calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

Record: CVE-2026-73249
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-73249 7.5

Record: DEBIAN-CVE-2026-73249
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-73249 7.5

Record: UBUNTU-CVE-2026-73249
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

kovidgoyal calibre

Affected packages

Affected packages
Package	Affected	Fixed
`calibre` Debian:12	All versions, plus listed versions 6.13.0+repack-26.13.0+repack-2+deb12u16.13.0+repack-2+deb12u106.13.0+repack-2+deb12u26.13.0+repack-2+deb12u3 Show 45 moreShow less 6.13.0+repack-2+deb12u46.13.0+repack-2+deb12u56.13.0+repack-2+deb12u66.13.0+repack-2+deb12u76.13.0+repack-2+deb12u86.13.0+repack-2+deb12u96.14.0-16.14.1-16.15.0-16.15.1-16.15.1-26.15.1-36.15.1-46.16.0-16.17.0-16.18.1-16.18.1-26.18.1-36.19.1-16.20.0-16.21.0-16.21.0-26.22.0-16.23.0-16.23.0-26.24.0+ds-16.24.0-16.24.0-26.25.0+ds-16.26.0+ds-16.27.0+ds-16.28.0+ds-16.28.1+ds-16.29.0+ds-17.0.0+ds-17.1.0+ds-17.1.0+ds-27.10.0+ds-17.11.0+ds-17.12.0+ds-17.12.0+ds-27.12.0+ds-37.13.0+ds-17.13.0+ds-27.14.0+ds-1	None known
`calibre` Debian:13	All versions, plus listed versions 8.10.0+ds-18.10.0+ds-28.10.0+ds-38.11.0+ds+~0.10.5-18.11.1+ds+~0.10.5-1 Show 45 moreShow less 8.11.1+ds+~0.10.5-28.11.1+ds+~0.10.5-38.12.0+ds+~0.10.5-18.13.0+ds+~0.10.5-18.13.0+ds+~0.10.5-28.13.0+ds+~0.10.5-38.14.0+ds+~0.10.5-18.14.0+ds+~0.10.5-1~bpo13+18.15.0+ds+~0.10.5-18.15.0+ds+~0.10.5-1~bpo13+18.15.0+ds+~0.10.5-28.16.0+ds+~0.10.5-18.16.0+ds+~0.10.5-28.16.1+ds+~0.10.5-18.16.2+ds+~0.10.5-18.16.2+ds+~0.10.5-28.16.2+ds+~0.10.5-38.16.2+ds+~0.10.5-3~bpo13+18.5.0+ds-18.5.0+ds-1+deb13u18.5.0+ds-1+deb13u28.5.0+ds-1+deb13u38.6.0+ds-18.7.0+ds-18.8.0+ds-18.8.0+ds-28.8.0+ds-2+gcc158.8.0+ds-38.9.0+ds-18.9.0+ds-28.9.0+ds-38.9.0+ds-49.0.0+ds+~0.10.5-19.1.0+ds+~0.10.5-19.10.0+ds+~0.10.6-19.10.0+ds+~0.10.6-29.11.0+ds+~0.10.6-19.11.0+ds+~0.10.6-29.12.0+ds+~0.10.6-19.13.0+ds+~0.10.6-19.14.0+ds+~0.10.6-19.14.0+ds+~0.10.6-29.15.0+ds+~1.1.2-19.15.0+ds+~1.1.2-29.15.0+ds+~1.1.2-3	None known
`calibre` Debian:14	before 9.12.0+ds+~0.10.6-1, plus listed versions 8.10.0+ds-18.10.0+ds-28.10.0+ds-38.11.0+ds+~0.10.5-18.11.1+ds+~0.10.5-1 Show 45 moreShow less 8.11.1+ds+~0.10.5-28.11.1+ds+~0.10.5-38.12.0+ds+~0.10.5-18.13.0+ds+~0.10.5-18.13.0+ds+~0.10.5-28.13.0+ds+~0.10.5-38.14.0+ds+~0.10.5-18.14.0+ds+~0.10.5-1~bpo13+18.15.0+ds+~0.10.5-18.15.0+ds+~0.10.5-1~bpo13+18.15.0+ds+~0.10.5-28.16.0+ds+~0.10.5-18.16.0+ds+~0.10.5-28.16.1+ds+~0.10.5-18.16.2+ds+~0.10.5-18.16.2+ds+~0.10.5-28.16.2+ds+~0.10.5-38.16.2+ds+~0.10.5-3~bpo13+18.5.0+ds-18.6.0+ds-18.7.0+ds-18.8.0+ds-18.8.0+ds-28.8.0+ds-2+gcc158.8.0+ds-38.9.0+ds-18.9.0+ds-28.9.0+ds-38.9.0+ds-49.0.0+ds+~0.10.5-19.1.0+ds+~0.10.5-19.10.0+ds+~0.10.6-19.10.0+ds+~0.10.6-29.11.0+ds+~0.10.6-19.11.0+ds+~0.10.6-29.2.0+ds+~0.10.5-19.2.1+ds+~0.10.5-19.2.1+ds+~0.10.5-29.3.0+ds+~0.10.5-19.3.1+ds+~0.10.5-19.4.0+ds+~0.10.5-19.5.0+ds+~0.10.5-19.6.0+ds+~0.10.5-19.6.0+ds+~0.10.5-29.6.0+ds+~0.10.5-3	9.12.0+ds+~0.10.6-1
`calibre` Ubuntu:16.04:LTS	All versions, plus listed versions 2.33.0+dfsg-1build12.38.0+dfsg-12.45.0+dfsg-12.45.0+dfsg-1build12.48.0+dfsg-1 Show 4 moreShow less 2.48.0+dfsg-1build12.54.0+dfsg-12.55.0+dfsg-12.55.0+dfsg-1ubuntu0.2	None known
`calibre` Ubuntu:18.04:LTS	All versions, plus listed versions 3.7.0+dfsg-23.7.0+dfsg-2build13.12.0+dfsg-13.13.0+dfsg-13.14.0+dfsg-1 Show 10 moreShow less 3.15.0.1+dfsg-13.16.0+dfsg-13.16.0+dfsg-1build13.17.0+dfsg-13.17.0+dfsg-23.18.0+dfsg-1build13.19.0+dfsg-13.20.0+dfsg-13.21.0+dfsg-13.21.0+dfsg-1build1	None known
`calibre` Ubuntu:20.04:LTS	All versions, plus listed versions 3.46.0+dfsg-14.2.0+dfsg-24.3.0+dfsg-14.3.0+dfsg-24.4.0+dfsg-1 Show 14 moreShow less 4.5.0+dfsg-14.5.0+dfsg-24.5.0+dfsg-34.6.0+dfsg-14.7.0+dfsg-14.99.3+dfsg-24.99.4+dfsg-14.99.4+dfsg-1build14.99.4+dfsg+really4.10.0+py3-24.99.4+dfsg+really4.11.2-14.99.4+dfsg+really4.11.2-1build14.99.4+dfsg+really4.12.0-14.99.4+dfsg+really4.12.0-1build14.99.4+dfsg+really4.12.0-1ubuntu1	None known
`calibre` Ubuntu:22.04:LTS	All versions, plus listed versions 5.25.0+dfsg-25.33.2+dfsg-15.34.0+dfsg-15.35.0+dfsg-1ubuntu25.37.0+dfsg-15.37.0+dfsg-1build1	None known
`calibre` Ubuntu:24.04:LTS	All versions, plus listed versions 6.24.0+ds-16.29.0+ds-17.0.0+ds-17.1.0+ds-17.1.0+ds-2 Show 9 moreShow less 7.2.0+ds-17.2.0+ds-1build17.3.0+ds-17.4.0+ds-17.5.1+ds-17.5.1+ds-27.5.1+ds-37.6.0+ds-17.6.0+ds-1build1	None known
`calibre` Ubuntu:26.10	All versions, plus listed versions 9.2.1+ds+~0.10.5-2build19.9.0+ds+~0.10.6-19.11.0+ds+~0.10.6-19.11.0+ds+~0.10.6-29.13.0+ds+~0.10.6-19.14.0+ds+~0.10.6-2build1	None known
`calibre` Ubuntu:26.04:LTS	All versions, plus listed versions 8.8.0+ds-3build18.13.0+ds+~0.10.5-38.14.0+ds+~0.10.5-18.15.0+ds+~0.10.5-18.16.0+ds+~0.10.5-2 Show 4 moreShow less 8.16.2+ds+~0.10.5-18.16.2+ds+~0.10.5-28.16.2+ds+~0.10.5-39.2.1+ds+~0.10.5-2build1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-73249 is a high vulnerability (CVSS 7.5) in Kovidgoyal Calibre, published August 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in calibre 9.12.0+ds+~0.10.6-1.

References

This page doesn't list everything

Left out here: 158 versions. The JSON record has them.