{"id":"CVE-2021-3987","aliases":["GHSA-fj5v-w2jp-wqvj","PYSEC-2026-1229"],"title":"Improper Access Control in janeczku/calibre-web","summary":"Improper Access Control in janeczku/calibre-web","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","vendor":"calibreweb","product":"calibreweb","ecosystem":"pip","affected":["calibreweb < 0.6.15"],"patched":["calibreweb 0.6.15"],"published":"2024-11-15","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-fj5v-w2jp-wqvj","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3987"},{"url":"https://github.com/janeczku/calibre-web/commit/bcdc97641447965af486964537f3821f47b28874"},{"url":"https://github.com/janeczku/calibre-web"},{"url":"https://huntr.com/bounties/29fcc091-87b6-43bc-ab4b-3c0bec3f71df"}],"tags":["osv","pip"],"epss":0.00346,"epssPercentile":0.2827,"ingestedAt":"2026-07-08T18:25:48.922Z","slug":"CVE-2021-3987","body":"## Overview\n\nAn improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.\n\n## Affected packages\n\n- `calibreweb < 0.6.15`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `calibreweb 0.6.15`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}