Unauthorized Access in Audiobookshelf Server by Advplyr
CVE-2026-42883

6.5MEDIUM

Key Information:

Vendor

Advplyr

Status
Audiobookshelf
Vendor
CVE Published:
11 May 2026

What is CVE-2026-42883?

Audiobookshelf, a self-hosted audiobook and podcast server, contains a vulnerability in its GET API endpoint which allows authenticated users to exfiltrate file contents from libraries they do not have permission to access. This occurs because the endpoint validates the library access only based on the user’s rights to a specific library while permitting downloadable items through attacker-provided IDs without proper restrictions. As a result, even if a user is restricted from viewing certain libraries, they can gain access to sensitive content from those libraries. This issue was resolved in version 2.32.2.

Affected Version(s)

audiobookshelf < 2.32.2

References

https://github.com/advplyr/audiobookshelf/security/adviso...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.