CVE-2021-3987: Janeczku Calibre-Web

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.

Affected products

• Janeczku Calibre-Web: before 0.6.15 (fixed in 0.6.15)

Published 2024-11-15. Last modified 2026-06-17.