Read the docs
TI-2021-02883 Aliases CVE-2021-3986GHSA-m982-h4f8-g4hf

Information Disclosure in janeczku/calibre-web

Priority MEDIUM 53CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-209.

Summary

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00371 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed calibreweb (PyPI): 0.6.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
janeczkujaneczku/calibre-webup to latest—No fix listedCNA
—calibreweb (PyPI)before 0.6.150.6.15Patch availableGHSA-m982-h4f8-g4hf
  • janeczku/calibre-web Vendorjaneczku Affected up to latest Fixed in — No fix listed CNA
  • calibreweb (PyPI) Vendor— Affected before 0.6.15 Fixed in 0.6.15 Patch available GHSA-m982-h4f8-g4hf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:*before 0.6.15Vulnerablejaneczku
  • cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:* Versions before 0.6.15 Vulnerable ·janeczku

Remediation

  • Fix · GHSA-m982-h4f8-g4hf calibreweb (PyPI) Fixed in 0.6.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3986
  2. 2026-10-03 Alias added: GHSA-m982-h4f8-g4hf

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2023-01981 Weak Password Requirements in janeczku/calibre-web CVSS 3.1CRITICAL 9.8
  • TI-2022-02333 Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web CVSS 3.1CRITICAL 9.8
  • TI-2021-07971 Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2025-06745 Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C CVSS 4.0MEDIUM 5.9
  • TI-2021-02885 Cross-site Scripting (XSS) in janeczku/calibre-web CVSS 3.1MEDIUM 6.1
  • TI-2024-26178 In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to… CVSS 3.1MEDIUM 5.4
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences