Executive brief
Grimmory is a self-hosted library application for managing ebooks, comics, and audiobooks. A flaw in the Kobo book download endpoint allows users with a valid Kobo token to download book files from libraries they should not have access to, potentially exposing content across the entire library without proper authorization checks.
Technical details
An authorization bypass exists in the streamFileToResponse function of the Kobo download endpoint (GET /api/kobo/{token}/v1/books/{bookId}/download) due to missing library-level access control validation. A user with the syncKobo permission and knowledge of arbitrary book IDs can download EPUB or CBX files from libraries to which they are not assigned. The same validateBookContentAccess check used in OPDS and Komga paths is absent in the Kobo path, allowing the vulnerability to bypass intended multi-library access restrictions.
Affected products
- grimmory-tools grimmory up to 3.3.3 and 3.4.1
Timeline
- 2026-09-19: disclosed
- other: Issue #2431 closed but no patching commit identified