Description

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T22:19:05.687Z",
  "pubdate": "2026-08-11T22:19:05.687Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt}. The flaw stems from an omission of the write access check flag within the routing mechanism, permitting unauthorized modification of reading annotations.\nThe vulnerability affects calibre prior to version 9.12.0. If successfully exploited, anonymous users on unauthenticated deployments or authenticated users restricted to read-only roles can execute arbitrary annotation updates against the underlying database.\nThe risk implications involve data integrity violations, as malicious or unauthorized actors can inject, overwrite, or corrupt persistent book annotations such as bookmarks, highlights, and notes without holding the requisite administrative or write privileges.\nExploitation requires network accessibility to the calibre Content Server and the ability to issue HTTP POST requests containing crafted JSON payloads to the vulnerable endpoint. No complex pre-conditions or user interaction are strictly required if the deployment lacks authentication.",
  "technicalDetails": "The root cause of the vulnerability resides in src/calibre/srv/books.py within the calibre Content Server implementation. Specifically, the HTTP POST endpoint handler corresponding to /book-update-annotations/{library_id}/{book_id}/{fmt} fails to specify the needs_db_write=True parameter.\nDuring request processing, the central routing framework, Router.dispatch(), relies on this flag to determine whether write access controls must be enforced. Because needs_db_write=True is omitted, Router.dispatch() completely bypasses the mandatory ctx.check_for_write_access() authorization check.\nConsequently, the update_annotations() function processes the request and directly passes attacker-controlled JSON input to db.merge_annotations_for_book(), committing the untrusted data directly to the calibre database.\nThe attack flow proceeds as follows: 1) An unauthenticated anonymous user or a restricted read-only user crafts an HTTP POST request targeting the vulnerable /book-update-annotations/{library_id}/{book_id}/{fmt} endpoint on a network-exposed calibre Content Server instance. 2) The request contains a serialized JSON payload representing malicious or unauthorized book annotations. 3) The calibre Content Server receives the request and invokes Router.dispatch(). Due to the missing needs_db_write=True configuration, the routing logic skips context-based write access validation. 4) The update_annotations() handler executes, accepting the input without verifying the session's privilege level. 5) The backend database function db.merge_annotations_for_book() merges the attacker payload into the targeted library database, persisting the unauthorized changes.\nAffected versions include all calibre releases prior to version 9.12.0. The vulnerable component is the calibre Content Server request dispatcher and book annotation handling subsystem located in src/calibre/srv/books.py."
}