Medium severity · published Nov 15, 2024
CVE-2021-3986
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Calibre-web · Janeczku
before 0.6.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3986
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3986
Patch
https://github.com/janeczku/calibre-web/commit/6f5390ead5df9779ac81fadefffb476e03f93548
Exploit
https://huntr.com/bounties/394af194-61a7-4e33-b373-877d4c766fca
More from Calibre-web
9.9
CVE-2022-0939
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18
9.9
CVE-2022-0767
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17
9.8
CVE-2025-7404
Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C
9.8
CVE-2023-2106
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20
9.8
CVE-2022-2525
Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20