CVE-2026-7714

crocodilestick Calibre-Web-Automated Admin Endpoint cwa_functions.py missing authentication

CVSS 6.9 MEDIUMEPSS 0.5%CWE-287 CWE-306

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 6.9EPSS 0.5%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Lifecycle

04 May 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file cps/cwa_functions.py of the component Admin Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

crocodilestick · Calibre-Web-Automated

public PoCs found — 1

cve_referencegist.github.com/menelausx/1b45c952d352a2ebdc01cd8d5aa88e87unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://gist.github.com/menelausx/1b45c952d352a2ebdc01cd8d5aa88e87 https://github.com/crocodilestick/Calibre-Web-Automated/https://github.com/crocodilestick/Calibre-Web-Automated/issues/1304 https://github.com/crocodilestick/Calibre-Web-Automated/pull/1308 https://vuldb.com/submit/806468 https://vuldb.com/vuln/360890 https://vuldb.com/vuln/360890/cti