VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Nov 15, 2024· Updated Jun 17, 2026

CVE-2021-3987

CVE-2021-3987

Description

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the create_shelf method in shelf.py not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
calibrewebPyPI
< 0.6.150.6.15

Affected products

3
  • ghsa-coords
    pkg:pypi/calibreweb
    Range: < 0.6.15
  • Janeczku/Calibre Web2 versions
    cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:*range: <0.6.15
    • (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.