CVE-2026-44775: Kavita: No authentication at /api/Reader/image
Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing completely unauthenticated access to page images from any chapter in any library. While the endpoint accepts an apiKey parameter, it is never validated. Since entity IDs are sequential integers, an unauthenticated attacker can trivially enumerate all content on the server. This vulnerability is fixed in 0.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kavitato a version that resolves this vulnerability.Fixed in 0.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44775?
CVE-2026-44775 has a medium severity rating of 6.9.
What is CVE-2026-44775 about?
CVE-2026-44775 is a vulnerability in Kavita allowing unauthenticated access to images via the ReaderController.GetImage endpoint.
How do I fix CVE-2026-44775?
To fix CVE-2026-44775, upgrade to Kavita version 0.9.0 or later which addresses the authentication issue.
What are the implications of CVE-2026-44775?
The implications of CVE-2026-44775 include potential unauthorized access to sensitive page images within any library.
Which software is affected by CVE-2026-44775?
CVE-2026-44775 affects the Kavita reading server prior to version 0.9.0.