CVE-2026-57562

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10.

• CWE-639

• https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de
• https://github.com/readest/readest/pull/4638
• https://github.com/readest/readest/releases/tag/v0.11.10
• https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8
• https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8

Published

Nov 4, 2026

Last Modified

Nov 5, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57546Transient DOS when processing a continuous receive command w…7.5
• CVE-2026-5755Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5…6.5
• CVE-2026-57554Memory Corruption when asynchronous threads access shared pe…7.8
• CVE-2026-57555Memory Corruption when executing system service routines due…7.8
• CVE-2026-57559Memory corruption while processing service requests.7.8
• CVE-2026-5756Unauthenticated Configuration File Modification Vulnerabilit…7.5
• CVE-2026-57565Readest is a modern, feature-rich ebook reader designed for …6.5
• CVE-2026-57566Readest is a modern, feature-rich ebook reader designed for …9.3
• CVE-2026-57567Readest is a modern, feature-rich ebook reader designed for …8.6
• CVE-2026-57568Lychee is a free, open-source photo-management tool. Prior t…5.7
• CVE-2026-57569Lychee is a free, open-source photo-management tool. Prior t…2.3
• CVE-2026-5757Unauthenticated remote information disclosure vulnerability …7.5