CVE-2026-42884CWE-863

Audiobookshelf: Collection endpoints bypass library access controls exposing restricted library data

Medium · published May 11, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collections and GET /api/collections/:id endpoints return collections from all libraries without checking whether the requesting user has access to each collection's library. An authenticated user with access to any library can enumerate and read collections (including full book metadata) from libraries they are explicitly restricted from accessing. This vulnerability is fixed in 2.32.2.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-11T19:52Z
EPSS history
Timeline
  • 11 MAY 19:52Z
    Audiobookshelf: Collection endpoints bypass library access controls exposing restricted library data
    cvelistv5