CVE-2026-7713

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the file cps/kobo_auth.py of the component Kobo auth-token Route. The manipulation results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.0.7 addresses this issue. The patch is identified as 9f50bb2c16160564c9f8777dc2ceed3eb95e4807. The affected component should be upgraded.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: May 4, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771305.3The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key t CVE-2026-771315.3When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitat CVE-2026-771325.3It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowe CVE-2026-771336.0The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses CVE-2026-771348.3The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmat CVE-2026-771358.2The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visit CVE-2026-771369.5The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as CVE-2026-771377.7The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inje CVE-2026-771389.3The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, una CVE-2026-771396.0The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask temp CVE-2026-77146.5A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file CVE-2026-771408.7The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that pers