Skip to content
OpenAdvisories

Vendor

Kareadita

10 known vulnerabilities.

Products

Kavita 6 kareadita/kavita 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-44776

    Kavita: IDOR in /api/Download/*

    Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization. A low-privileged user who knows or guesses a chapterId, volumeId, or seriesId belonging to a librar…

    Kareadita Kavita
  • Medium 6.9
    CVE-2026-44775

    Kavita: No authentication at /api/Reader/image

    Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing completely unauthenticated access to page images from any chapter in any library. While the endpoint accepts an apiK…

    Kareadita Kavita