CVE-2026-73249: calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{libraryid}/{bookid}/{fmt} in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch() to skip ctx.checkforwriteaccess() before updateannotations() passes attacker-controlled JSON to db.mergeannotationsforbook(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
calibre Content Serverto a version that resolves this vulnerability.Fixed in 9.12.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73249?
The severity of CVE-2026-73249 is rated high with a score of 7.5.
How do I fix CVE-2026-73249?
To fix CVE-2026-73249, upgrade to calibre version 9.12.0 or later.
What type of vulnerability is CVE-2026-73249?
CVE-2026-73249 is a missing write authorization check vulnerability in calibre Content Server.
What can attackers do with CVE-2026-73249?
Attackers can exploit CVE-2026-73249 to perform unauthorized modifications to annotations in the calibre Content Server.
Which software is affected by CVE-2026-73249?
CVE-2026-73249 affects the calibre Content Server prior to version 9.12.0.