Vulnerability Description
Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing completely unauthenticated access to page images from any chapter in any library. While the endpoint accepts an apiKey parameter, it is never validated. Since entity IDs are sequential integers, an unauthenticated attacker can trivially enumerate all content on the server. This vulnerability is fixed in 0.9.0.
Related Weaknesses (CWE)
References
- https://github.com/Kareadita/Kavita/blob/8c686df2dbc2d0a83120e8b3f8c1269107bb815
- https://github.com/Kareadita/Kavita/security/advisories/GHSA-6gc9-6r8p-5wg2
FAQ
What is CVE-2026-44775?
CVE-2026-44775 is a documented vulnerability. Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing completely unauthenticated access to page images from any...
How severe is CVE-2026-44775?
CVSS scoring is not yet available for CVE-2026-44775. Check NVD for updates.
Is there a patch for CVE-2026-44775?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.