CVE-2026-7714

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file cps/cwa_functions.py of the component Admin Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-287 CWE-306

Affected software

No affected versions have been published.

Timeline

Published: May 4, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771408.7The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that pers CVE-2026-771418.8The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, bu CVE-2026-771428.8The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a vis CVE-2026-771438.8The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a CVE-2026-771447.1The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no CVE-2026-771457.1The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user w CVE-2026-771468.3The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or CVE-2026-771476.5Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for CVE-2026-771489.9A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&secti CVE-2026-77156.3A vulnerability has been found in ravenwits mcp-server-arangodb up to 0.4.7. This affects the function arango_backup of the file src/tools.t CVE-2026-771506.1The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all CVE-2026-771513.7A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/uti