Quick answers
- Is CVE-2026-42883 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42883 being exploited in the wild.
- How severe is CVE-2026-42883?
- Medium severity, with a CVSS score of 6.5, published 11 May 2026.
- Which products and versions are affected?
- Advplyr Audiobookshelf < 2.32.2.
- Is there a fix for CVE-2026-42883?
- A patch was published on 2026-05-11: Fix released in version 2.32.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42883 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-42883?
- Check whether you run Advplyr Audiobookshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An incorrect authorization vulnerability exists in the `downloadMultiple` handler within `server/controllers/LibraryController.js`. While the endpoint validates that a user has access to the library ID provided in the URL path, the underlying database query for the `ids` parameter fails to include a `libraryId` constraint. An attacker with a valid session and `canDownload` permissions can provide IDs of items belonging to other libraries in the query string. The server will then fetch these items and stream them as a ZIP file, bypassing the `librariesAccessible` permission model. This issue is resolved in version 2.32.2 by adding the `libraryId` constraint to the Sequelize `findAll` query.
Affected products
- advplyr Audiobookshelf < 2.32.2
Timeline
- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix released in version 2.32.2