{"id":"CVE-2021-4171","kind":"vulnerability","aliases":["CVE-2021-4171","GHSA-xp7p-3gx7-j6wx"],"related":[],"title":"calibre-web is vulnerable to Business Logic Errors","description":"calibre-web is vulnerable to Business Logic Errors","summary":"calibre-web, a web front end for the Calibre ebook library, contains business logic errors that the advisory rates critical (CVSS 9.8). The sources do not state the exact exploit path, so the consequence is only known as a serious access or logic bypass.","severity":"critical","cvss":9.8,"epss":0.01387,"exploited":false,"exploited_at":null,"products":[{"name":"calibreweb","fixed":["0.6.15"],"affected":"< 0.6.15","ecosystem":"pypi"},{"name":"janeczku calibre-web","fixed":["0.6.15"],"affected":"< 0.6.15","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["calibre-web","package","python","self-hosted"],"not_affected_if":["version-0.6.15-or-later"],"how_to_check":"- Run `pip show calibreweb` and confirm the installed version is below `0.6.15`\n- unknown for any other check, since the sources do not describe the affected feature","fix":"- Upgrade the pypi package `calibreweb` to `0.6.15` or later","status":"open","published_at":"2022-01-17T10:15:07+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","triaged_at":"2026-10-27T16:21:28+00:00","updated_at":"2026-10-27T16:33:07+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-27T16:21:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the pypi package `calibreweb` to `0.6.15` or later","reach":"unknown","title":"calibre-web: business logic errors let attackers bypass access controls","impact":"high","summary":"calibre-web, a web front end for the Calibre ebook library, contains business logic errors that the advisory rates critical (CVSS 9.8). The sources do not state the exact exploit path, so the consequence is only known as a serious access or logic bypass.","category":"package","nicknames":[],"who_cares":["python","self-hosted","calibre-web"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown, sources only rate the flaw critical","analyst_note":"Find the GHSA-xp7p-3gx7-j6wx details to confirm the exploit path, required auth, and the exposed feature.","how_to_check":"- Run `pip show calibreweb` and confirm the installed version is below `0.6.15`\n- unknown for any other check, since the sources do not describe the affected feature","needs_analyst":true,"not_affected_if":["version-0.6.15-or-later"],"who_is_affected":"Deployments of calibre-web installed from PyPI at a version below 0.6.15 are affected. The sources do not say which feature or configuration triggers the business logic error, so whether a given instance is exposed is unknown. Instances already on 0.6.15 or later are not affected by this advisory.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000591,"input_tokens":3277,"output_tokens":526,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2021':11A,19A '-4171':12A,20A '3gx7':16A '9.8':56B 'access':75B 'advisori':52B 'busi':7A,47B,85C 'bypass':78B 'calibr':2A,27B,35B,43B,80C 'calibre':24A 'calibre-web':1A,23A,26B,34B,79C 'calibreweb':21A 'consequ':68B 'contain':46B 'critic':54B 'cve':10A,18A 'cvss':55B 'ebook':44B 'end':40B 'error':9A,49B,87C 'exact':63B 'exploit':64B 'front':39B 'ghsa':14A 'ghsa-xp7p-3gx7-j6wx':13A 'host':33B 'j6wx':17A 'janeczku':22A 'known':71B 'librari':45B 'logic':8A,48B,77B,86C 'packag':29B 'path':65B 'python':30B 'rate':53B 'self':32B 'self-host':31B 'serious':74B 'sourc':58B 'state':61B 'vulner':5A,83C 'web':3A,25A,28B,36B,38B,81C 'xp7p':15A","nicknames":[],"mitigations":[],"who_affected":"Deployments of calibre-web installed from PyPI at a version below 0.6.15 are affected. The sources do not say which feature or configuration triggers the business logic error, so whether a given instance is exposed is unknown. Instances already on 0.6.15 or later are not affected by this advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-01-17T10:15:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xp7p-3gx7-j6wx","url":"https://github.com/advisories/GHSA-xp7p-3gx7-j6wx","severity":"critical","published_at":"2022-01-21T23:44:15+00:00","modified_at":"2026-10-27T16:16:33+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","fetched_at":"2026-10-27T16:20:27+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-4171","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4171","severity":null,"published_at":"2022-01-17T10:15:07+00:00","modified_at":"2026-06-17T04:19:09+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}