Executive brief
Kavita is a self-hosted digital library server used for managing and reading comics, manga, and books. A security flaw in the software's authorization logic allows users who have permission to download content to access files from libraries they are not supposed to see. By guessing or predicting internal ID numbers, a restricted user could download full books, view file sizes, and read metadata from private collections belonging to other users or the administrator.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) (CWE-639) within the `DownloadController` and `ChapterController`. While these controllers enforce a general 'Download' role policy, they fail to verify if the authenticated user has been granted access to the specific library containing the requested `chapterId`, `volumeId`, or `seriesId`. Because Kavita uses sequential integer IDs for these entities, an authenticated attacker can enumerate IDs to download full file contents, query file sizes, and leak chapter metadata via endpoints such as `/api/Download/volume` and `/api/Chapter`. The fix, introduced in version 0.9.0, implements library-scoped filtering using existing `HasAccessToLibrary` and `HasAccessToSeries` helpers.
Affected products
- Kareadita Kavita < 0.9.0
Timeline
- 2026-05-05: advisory: GitHub Security Lab advisory published
- 2026-05-26: disclosed: CVE published to NVD
- 2026-05-26: patched: Fixed in version 0.9.0