# CVE-2026-42883: advplyr Audiobookshelf incorrect authorization in bulk download endpoint

Source: https://junglewise.ai/threats/cve-2026-42883-advplyr-audiobookshelf-incorrect-authorization-in-bulk-download  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-42883 · Severity: medium · CVSS 6.5 · Published 2026-05-11

Audiobookshelf is a self-hosted server for managing audiobooks and podcasts. A security flaw in the system's download feature allows an authorized user to download files from libraries they are not permitted to access. By providing specific file identifiers in a download request, an attacker can bypass library-level restrictions and exfiltrate private audiobooks, podcasts, or ebooks.

Technologies: [Advplyr Audiobookshelf](https://junglewise.ai/threats/technologies/audiobookshelf). Vendors: [Advplyr](https://junglewise.ai/threats/vendors/advplyr).

## Quick answers

**Is CVE-2026-42883 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42883 being exploited in the wild.

**How severe is CVE-2026-42883?** Medium severity, with a CVSS score of 6.5, published 11 May 2026.

**Which products and versions are affected?** Advplyr Audiobookshelf < 2.32.2.

**Is there a fix for CVE-2026-42883?** A patch was published on 2026-05-11: Fix released in version 2.32.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42883 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42883?** Check whether you run Advplyr Audiobookshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability exists in the `downloadMultiple` handler within `server/controllers/LibraryController.js`. While the endpoint validates that a user has access to the library ID provided in the URL path, the underlying database query for the `ids` parameter fails to include a `libraryId` constraint. An attacker with a valid session and `canDownload` permissions can provide IDs of items belonging to other libraries in the query string. The server will then fetch these items and stream them as a ZIP file, bypassing the `librariesAccessible` permission model. This issue is resolved in version 2.32.2 by adding the `libraryId` constraint to the Sequelize `findAll` query.

## Affected products

- advplyr Audiobookshelf < 2.32.2

## Timeline

- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix released in version 2.32.2

## References

- [https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-6rvg-w3f5-9gq5](https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-6rvg-w3f5-9gq5)

## Related threats

- [advplyr Audiobookshelf path traversal in PodcastController](https://junglewise.ai/threats/cve-2026-42888-advplyr-audiobookshelf-path-traversal-in-podcastcontroller)
- [advplyr Audiobookshelf stored XSS in Login Page](https://junglewise.ai/threats/cve-2026-42887-advplyr-audiobookshelf-stored-xss-in-login-page)
- [advplyr Audiobookshelf DoS via memory exhaustion in backup upload](https://junglewise.ai/threats/cve-2026-42886-advplyr-audiobookshelf-dos-via-memory-exhaustion-in-backup-upload)
- [Audiobookshelf path traversal in filesystem existence check](https://junglewise.ai/threats/cve-2026-42885-audiobookshelf-path-traversal-in-filesystem-existence-check)
- [advplyr Audiobookshelf incorrect authorization in collection endpoints](https://junglewise.ai/threats/cve-2026-42884-advplyr-audiobookshelf-incorrect-authorization-in-collection)