Quick answers
- Is CVE-2026-42884 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42884 being exploited in the wild.
- How severe is CVE-2026-42884?
- Medium severity, with a CVSS score of 4.3, published 11 May 2026.
- Which products and versions are affected?
- Advplyr Audiobookshelf < 2.32.2.
- Is there a fix for CVE-2026-42884?
- A patch was published on 2026-05-11: Fix confirmed in version 2.32.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42884 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-42884?
- Check whether you run Advplyr Audiobookshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The GET /api/collections and GET /api/collections/:id endpoints in Audiobookshelf (prior to 2.32.2) fail to validate if the requesting user has access to the library associated with a collection. The root cause is located in 'server/controllers/CollectionController.js', where the 'findAll' method calls 'getOldCollectionsJsonExpanded' without a 'libraryId' parameter, causing the database query to return all collections regardless of user permissions. An authenticated attacker can exploit this to leak collection names, book metadata, and full filesystem paths. This vulnerability can also serve as an information gathering step for further attacks using leaked library item IDs. The issue is fixed in version 2.32.2.
Affected products
- advplyr Audiobookshelf < 2.32.2
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published by maintainer
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix confirmed in version 2.32.2