{"id":"CVE-2026-57562","kind":"vulnerability","aliases":["CVE-2026-57562"],"related":[],"title":"Readest: Stripe check endpoint grants paid plans without verifying session owner","description":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10.","summary":"Readest, an ebook reader, has an API endpoint that grants a paid subscription to the calling account using a Stripe Checkout Session ID without checking that the session belongs to that account. An authenticated free user can reuse a paid session ID to upgrade other accounts without paying.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","readest","self-hosted","stripe"],"not_affected_if":["no-stripe-billing","version-0.11.10-or-later"],"how_to_check":"- Check the Readest version in use; versions before `0.11.10` are affected.\n- Look for `apps/readest-app/src/app/api/stripe/check/route.ts` in the deployed source and confirm whether it verifies `session.metadata.userId`.","fix":"- Readest: move to `0.11.10` or later.","status":"open","published_at":"2026-11-04T22:18:06+00:00","first_seen_at":"2026-11-04T23:08:49+00:00","triaged_at":"2026-11-04T23:10:01+00:00","updated_at":"2026-11-04T23:10:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T23:10:01Z","model":"claude-haiku-5-5","output":{"fix":"- Readest: move to `0.11.10` or later.","reach":"internet","title":"Readest: Stripe check endpoint grants paid plans without verifying session owner","impact":"medium","summary":"Readest, an ebook reader, has an API endpoint that grants a paid subscription to the calling account using a Stripe Checkout Session ID without checking that the session belongs to that account. An authenticated free user can reuse a paid session ID to upgrade other accounts without paying.","audience":"businesses","category":"package","nicknames":[],"who_cares":["readest","self-hosted","stripe"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker grants paid plans to other accounts without paying","analyst_note":"","how_to_check":"- Check the Readest version in use; versions before `0.11.10` are affected.\n- Look for `apps/readest-app/src/app/api/stripe/check/route.ts` in the deployed source and confirm whether it verifies `session.metadata.userId`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.11.10-or-later","no-stripe-billing"],"who_is_affected":"Only deployments of Readest before `0.11.10` that run the Stripe check route and let users sign up for paid plans are exposed. The flaw needs a logged-in account, so deployments with no public sign-up or no Stripe billing are lower risk. unknown beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4440,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-57562':14A,17A '/api/stripe/check':97C '0.11.10':95C,182C 'accept':100C 'access':87C 'account':40B,55B,69B,173C 'activ':152C 'addit':172C 'api':30B 'apps/readest-app/src/app/api/stripe/check/route.ts':99C 'authent':57B,119C,146C 'belong':52B 'call':39B 'caller':120C,135C 'check':3A,48B 'checkout':44B,110C,142C,153C 'client':103C 'client-control':102C 'control':104C 'correspond':108C 'could':166C 'createorupdatesubscript':125C 'cross':85C 'cross-platform':84C 'cve':12A,15A 'design':81C 'ebook':26B,79C 'endpoint':4A,31B 'experi':92C 'featur':77C 'feature-rich':76C 'fix':179C 'free':58B,147C 'grant':5A,33B,113C 'host':22B 'id':46B,65B 'identifi':138C,155C,169C 'includ':156C 'intuit':90C 'issu':177C 'key':132C 'legitim':164C 'modern':75C 'one':157C 'owner':11A,144C 'packag':18B 'paid':6A,35B,63B,115C,151C 'path':126C 'pay':71B 'payment':175C 'plan':7A,116C,130C 'platform':86C 'post':96C 'prior':93C 'purchas':165C 'rather':139C 'read':91C 'reader':27B,80C 'readest':1A,19B,24B,72C 'replay':167C 'retriev':106C 'reus':61B 'rich':78C 'row':131C 'seamless':83C 'self':21B 'self-host':20B 'session':10A,45B,51B,64B,111C,143C,154C 'session.metadata.userid':123C 'sessionid':105C 'singl':163C 'stripe':2A,23B,43B,109C 'subscript':36B 'updat':128C 'upgrad':67B,171C 'use':41B 'user':59B,137C,148C,160C 'verifi':9A,122C 'version':181C 'without':8A,47B,70B,121C,174C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Readest before `0.11.10` that run the Stripe check route and let users sign up for paid plans are exposed. The flaw needs a logged-in account, so deployments with no public sign-up or no Stripe billing are lower risk. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","readest","selfhosted","stripe"],"campaign_type":null,"first_public_at":"2026-10-15T04:56:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57562","severity":null,"published_at":"2026-11-04T22:18:06+00:00","modified_at":"2026-11-04T22:18:06+00:00","first_seen_at":"2026-11-04T23:08:49+00:00","fetched_at":"2026-11-04T23:08:49+00:00","note":null}],"documents":[{"id":71165,"url":"https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71166,"url":"https://github.com/readest/readest/releases/tag/v0.11.10","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71167,"url":"https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-15T04:56:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}