Executive brief
Audiobookshelf is a self-hosted server for managing audiobooks and podcasts. A security flaw in the software allows any logged-in user to view information about collections and books in libraries they are not supposed to see. While this does not allow direct downloading of audio files, it exposes sensitive metadata such as book titles, descriptions, and server file paths.
Technical details
The GET /api/collections and GET /api/collections/:id endpoints in Audiobookshelf (prior to 2.32.2) fail to validate if the requesting user has access to the library associated with a collection. The root cause is located in 'server/controllers/CollectionController.js', where the 'findAll' method calls 'getOldCollectionsJsonExpanded' without a 'libraryId' parameter, causing the database query to return all collections regardless of user permissions. An authenticated attacker can exploit this to leak collection names, book metadata, and full filesystem paths. This vulnerability can also serve as an information gathering step for further attacks using leaked library item IDs. The issue is fixed in version 2.32.2.
Affected products
- advplyr Audiobookshelf < 2.32.2
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published by maintainer
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix confirmed in version 2.32.2