CVE-2026-57562

Name of the Vulnerable Software and Affected Versions Readest versions prior to 0.11.10

Description An issue exists where the application grants paid plans to authenticated users without properly verifying the session ownership. Specifically, the endpoint "/api/stripe/check" accepts a client-controlled sessionId to retrieve a Stripe Checkout Session but fails to verify the session.metadata.userId. Consequently, the createOrUpdateSubscription() function updates the subscription plan for the authenticated caller instead of the actual session owner. This allows an authenticated free user to reuse a valid paid Checkout Session identifier to upgrade multiple accounts without additional payment.

Recommendations Update to version 0.11.10.