advplyr audiobookshelf up to 2.32.1 File Content download authorization

Summaryinfo

A vulnerability identified as problematic has been detected in advplyr audiobookshelf up to 2.32.1. This affects an unknown function of the file /api/libraries/:id/download of the component File Content Handler. The manipulation leads to authorization. This vulnerability is uniquely identified as CVE-2026-42883. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in advplyr audiobookshelf up to 2.32.1 and classified as problematic. This issue affects some unknown functionality of the file /api/libraries/:id/download of the component File Content Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is confidentiality. The summary by CVE is:

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/libraries/:id/download endpoint validates that the requesting user has access to the library specified in the URL path, but fetches downloadable items solely by attacker-provided IDs without constraining them to that library. An authenticated user with download permission and access to any one library can exfiltrate the full file contents of items belonging to any other library, including libraries they are explicitly denied access to. This vulnerability is fixed in 2.32.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-42883 since 04/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 2.32.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• advplyr

Name

• audiobookshelf

Version

• 2.32.0
• 2.32.1

Website

• Product: https://github.com/advplyr/audiobookshelf/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion