Vulnerabilidades de Kareadita
CVEs publicadas que afetam produtos de Kareadita: 4 registro(s), com severidade, exploração e correções.
CVE-2026-110223
Baixa · 3.1
CWE-918 13/10/2026
Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses after validation, enabling blind internal port and service probing.
CVE-2026-47202
Crítica · 9.3
CWE-287 26/05/2026
Kavita: falha de autenticação permite obter JWT de qualquer usuário
Kavita é um servidor de leitura multiplataforma. Antes da versão 0.9.0.2, uma falha de validação de token inadequada permite que um agente de ameaça remoto e não autenticado solicite um JWT para qualquer usuário, incluindo administradores, desde que conheça o nome de usuário. Esta vulnerabilidade está corrigida na versão 0.9.0.2.
CVE-2026-44776
Média · 5.9
CWE-639 26/05/2026
Kavita: IDOR in /api/Download/*
Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization. A low-privileged user who knows or guesses a chapterId, volumeId, or seriesId belonging to a library they are not assigned to can download the full file contents, query file sizes, and read metadata for that content. This affects /api/Download/volume-size, /api/Download/chapter-size, /api/Download/series-size, /api/Download/volume, /api/Download/chapter, /api/Download/series, and /api/Chapter. This vulnerability is fixed in 0.9.0.
CVE-2026-44775
Média · 6.9
CWE-306 26/05/2026
Kavita: No authentication at /api/Reader/image
Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing completely unauthenticated access to page images from any chapter in any library. While the endpoint accepts an apiKey parameter, it is never validated. Since entity IDs are sequential integers, an unauthenticated attacker can trivially enumerate all content on the server. This vulnerability is fixed in 0.9.0.