CVE-2026-7709 | janeczku Calibre-Web up to 0.6.26 Endpoint cps/kobo_auth.py generate_auth_token user_id improper authorization

A vulnerability was found in janeczku Calibre-Web up to 0.6.26. It has been declared as critical. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of the component Endpoint. Such manipulation of the argument user_id leads to improper authorization.

This vulnerability is traded as CVE-2026-7709. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.