CVE-2021-4171: Business Logic Errors in calibre-web
Summary
CVE-2021-4171: calibre-web is vulnerable to Business Logic Errors. Affects calibreweb versions < 0.6.15. Fixed in 0.6.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
calibre-web is an open-source web application that provides a user interface for managing and accessing e-book libraries. It allows users to organize, browse, and download e-books from their calibre libraries. The application is written in Python and is available on the PyPI package repository. Unfortunately, calibre-web is vulnerable to Business Logic Errors, which can lead to critical security issues.
Vulnerability Detail
The Business Logic Errors in calibre-web can be exploited by attackers to bypass certain security measures or perform unauthorized actions. These errors occur in the 'check_shelf_is_unique' and 'create_edit_shelf' functions of the 'calibreweb.cps.shelf' module. By manipulating the logic of these functions, an attacker can potentially create duplicate shelves or modify existing ones without proper authorization. This can result in data corruption, unauthorized access to e-books, or other security breaches.
How To Fix
Latest published version: 0.6.27 as of 22 Oct 2026
pip install --upgrade "calibreweb==0.6.27"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.15
This is the first release that contains the fix.
pip install --upgrade "calibreweb==0.6.15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality related to shelf management until the application is updated. This can be achieved by modifying the application's configuration or access control settings to restrict access to the 'check_shelf_is_unique' and 'create_edit_shelf' functions. However, this workaround may limit the functionality of the application and is not a permanent solution.
Conclusion
In conclusion, calibre-web is vulnerable to Business Logic Errors that can be exploited by attackers to bypass security measures and perform unauthorized actions. It is crucial to update the application to the latest version (0.6.15 or later) to mitigate this vulnerability. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for calibreweb →
FAQ
calibre-web is an open-source web application that provides a user interface for managing and accessing e-book libraries.
The Business Logic Errors in calibre-web can lead to data corruption, unauthorized access to e-books, or other security breaches.
To fix this vulnerability, update calibre-web to version 0.6.15 or later.
As a temporary workaround, users can disable the affected functionality related to shelf management until the application is updated.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: [link to the vulnerability details]
Related vulnerabilities
Recent vulnerabilities recorded for calibreweb.
