CVE-2021-3986 json
Information Disclosure in janeczku/calibre-web
published 2024-11-15 23 mo ago modified 2026-07-07 4 mo ago also GHSA-m982-h4f8-g4hf , PYSEC-2026-1232 , EUVD-2024-3282
- cvss
- 4.3
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.
Patch / fix
- pypi calibreweb 0.6.15
- janeczku calibre-web 0.6.15
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/394af194-61a7-4e33-b373-877d4c766fca referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | calibreweb | <0.6.15 |
0.6.15 |
Affected products
- janeczku janeczku/calibre-web
- calibre-web_project calibre-web
Classification
- Weakness
-
- CWE-209 Generation of Error Message Containing Sensitive Information
References
-
github.com
/janeczku/calibre-web/commit/6f5390ead5df9779ac81fadefffb476e03f93548
web, patch
-
huntr.com
/bounties/394af194-61a7-4e33-b373-877d4c766fca
web, exploit, issue-tracking, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-3986
advisory
-
github.com
/janeczku/calibre-web
package
-
pypi.org
/project/calibreweb
package
-
github.com
/advisories/GHSA-m982-h4f8-g4hf
advisory
Sources
- CVE List CVE-2021-3986
- GitHub Advisory GHSA-m982-h4f8-g4hf
- NVD CVE-2021-3986
- OSV PYSEC-2026-1232
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.