CVE-2026-44775

Name of the Vulnerable Software and Affected Versions Kavita versions prior to 0.9.0

Description The ReaderController.GetImage endpoint is decorated with [AllowAnonymous], which permits unauthenticated access to page images from any chapter in any library. Although the endpoint accepts an apiKey parameter, it is not validated. Because entity IDs are sequential integers, an attacker can enumerate all content on the server.

Recommendations Update to version 0.9.0.