{"id":"CVE-2021-3987","aliases":["EUVD-2024-3244","GHSA-fj5v-w2jp-wqvj","PYSEC-2026-1229"],"status":"published","title":"Improper Access Control in janeczku/calibre-web","description":"An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00346,"percentile":0.28409,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-862"],"published":"2024-11-15T10:52:29Z","modified":"2026-10-20T10:54:54Z","fixes":[{"ecosystem":"PyPI","package":"calibreweb","fixed_in":["0.6.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"calibreweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.15"}]}]},{"source":"osv","ecosystem":"PyPI","package":"calibreweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.15"}]}],"versions":["0.6.12","0.6.13","0.6.14"]},{"source":"osv","ecosystem":"PyPI","package":"calibreweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.15"}]}],"versions":["0.6.12","0.6.13","0.6.14"]}],"products":[{"vendor":"calibre-web_project","product":"calibre-web"},{"vendor":"janeczku","product":"calibre-web"},{"vendor":"janeczku","product":"janeczku/calibre-web"}],"references":[{"url":"https://huntr.com/bounties/29fcc091-87b6-43bc-ab4b-3c0bec3f71df","tags":["Exploit","evidence","web"]},{"url":"https://github.com/janeczku/calibre-web/commit/bcdc97641447965af486964537f3821f47b28874","tags":["Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3987","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fj5v-w2jp-wqvj","tags":["advisory"]},{"url":"https://github.com/janeczku/calibre-web","tags":["package"]},{"url":"https://pypi.org/project/calibreweb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-3987","title":"Improper Access Control in janeczku/calibre-web","description":"An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.","status":"published","published":"2024-11-15T10:52:29.478Z","modified":"2024-11-15T18:28:12.925Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2024-3244","description":"An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.","status":"published","published":"2024-11-15T10:52:29Z","modified":"2024-11-15T18:28:12Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:58.20762Z"}],"ghsa":[{"id":"GHSA-fj5v-w2jp-wqvj","title":"Improper Access Control in janeczku/calibre-web","description":"An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.","status":"published","published":"2024-11-15T12:31:44Z","modified":"2024-11-19T20:47:08Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T14:38:21.777721Z"}],"nvd":[{"id":"CVE-2021-3987","description":"An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.","status":"published","published":"2024-11-15T11:15:06.61Z","modified":"2026-06-17T04:06:20.773Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T14:07:08.629518Z"}],"osv":[{"id":"CVE-2021-3987","description":"An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.","status":"published","published":"2024-11-15T11:15:06.61Z","modified":"2026-10-20T10:54:54.798258557Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"GHSA-fj5v-w2jp-wqvj","title":"Improper Access Control in janeczku/calibre-web","description":"An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.","status":"published","published":"2024-11-15T12:31:44Z","modified":"2026-07-07T17:57:15.471145559Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"PYSEC-2026-1229","title":"Improper Access Control in janeczku/calibre-web","description":"An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.","status":"published","published":"2026-07-07T14:34:44.645886Z","modified":"2026-07-07T17:47:33.604787337Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"}]}}