Calibre-Web Improper Authorization Vulnerability in Kobo Authentication Endpoint

An improper authorization vulnerability has been identified in Janeczku Calibre-Web versions through 0.6.26. The issue arises in the Endpoint component, specifically within the generate_auth_token function of the kobo_auth.py file. This vulnerability allows for unauthorized actions by manipulating the user_id argument, and can be exploited remotely. Publicly available exploits exist for this vulnerability.

Impact

Exploitation of this vulnerability allows for improper authorization, enabling persistent user impersonation.