CVE-2026-7714

A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file cps/cwa_functions.py of the component Admin Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

• CWE-287
• CWE-306

• https://gist.github.com/menelausx/1b45c952d352a2ebdc01cd8d5aa88e87
• https://github.com/crocodilestick/Calibre-Web-Automated/
• https://github.com/crocodilestick/Calibre-Web-Automated/issues/1304
• https://github.com/crocodilestick/Calibre-Web-Automated/pull/1308
• https://vuldb.com/submit/806468
• https://vuldb.com/vuln/360890
• https://vuldb.com/vuln/360890/cti

Published

May 4, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77134The extension fails to require the dedicated admin confirmat…8.3
• CVE-2026-77135The extension's user detail view fails to verify that a requ…8.2
• CVE-2026-77136The extension passes the raw value of a form field configure…9.5
• CVE-2026-77137The extension fails to properly sanitize user input before u…7.7
• CVE-2026-77138The extension fails to safely process untrusted client input…9.3
• CVE-2026-77139The extension fails to validate a client-supplied template e…6
• CVE-2026-77140The extension validates the HMAC of a frontend employee edit…8.7
• CVE-2026-77141The extension resolves the targeted club record from a user-…8.8
• CVE-2026-77142The frontend company self-service editing feature relies on …8.8
• CVE-2026-77143The frontend topic editing flow does not verify on the serve…8.8
• CVE-2026-77144The frontend management plugin attributed a newly created ev…7.1
• CVE-2026-77145The permission check for the frontend management update flow…7.1