CVE-2026-73249

Name of the Vulnerable Software and Affected Versions calibre versions prior to 9.12.0

Description The calibre Content Server contains an issue where the POST '/book-update-annotations/{library id}/{book id}/{fmt}' endpoint in 'src/calibre/srv/books.py' fails to specify needs db write=True. This causes the Router.dispatch() function to bypass the ctx.check for write access() check. Consequently, the update annotations() function allows attacker-controlled JSON to be passed to db.merge annotations for book(), enabling a read-only user or an anonymous user on an unauthenticated deployment to make unauthorized changes to book annotations.

Recommendations Update to version 9.12.0.