CVE-2026-73249 Missing authorization in calibre
An attacker can modify book annotations without authorization due to a missing write access check in the calibre Content Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73249?
CVE-2026-73249 is a high-severity missing authorization vulnerability in kovidgoyal calibre, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-73249?
How do I fix CVE-2026-73249?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-73249 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73249 exists.
Sources
Also known as DEBIAN-CVE-2026-73249, GHSA-5x64-w63v-x2g6, UBUNTU-CVE-2026-73249.