Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-62614

Good to know:

icon

Date: October 22, 2025

BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an authentication bypass vulnerability in the BookMediaController allows any unauthenticated user to access and download book covers, thumbnails, and complete PDF/CBX page content without authorization. The vulnerability exists because multiple media endpoints lack proper access control annotations, and the CoverJwtFilter continues request processing even when no authentication token is provided. This enables attackers to enumerate and exfiltrate all book content from the system, bypassing the intended download permissions (canDownload) entirely. This issue has been patched via commit b226c43.

Severity Score

Related Resources (4)

https://github.com/booklore-app/booklore/security/advisories/GHSA-363g-fhcq-hvqp
https://nvd.nist.gov/vuln/detail/CVE-2025-62614
https://github.com/booklore-app/booklore/commit/b226c43343cd0cef4c1cd54bc3dcdef90b147133
https://www.mend.io/vulnerability-database/CVE-2025-62614

Severity Score

Weakness Type (CWE)

Missing Authorization

CWE-862

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us