Kavita
v0.9.1.4Kavita is a fast, feature rich, cross platform reading server. Built with the goal of being a full solution for all your reading needs. Setup your own server and share your reading collection with your friends and family.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- GPL-3.0Copyleft · OSI-approved
- Security
- 12 advisories1 critical, 1 high, 6 medium, 4 low
- Supported versions
- No scheduleendoflife.date does not track this project
12.1k stars · 703 forks · 165 open issues · last release 2 months ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 12 most recent advisories published by the maintainers: 1 critical, 1 high, 6 medium, 4 low. Check the patched version against the one you run.
- highGHSA-x67v-89v8-mf3vSep 5, 2026Broken access control in /api/download/bookmarks lets any Download-capable user exfiltrate other users' bookmarked page images, including pages from libraries they are not granted
- Affected
- <= 0.9.0.2
- Patched in
- 0.9.1
- lowGHSA-jxx7-hp6f-5389Sep 5, 2026Authorization bypass through user-controlled key on `bulk-volume-size` / `bulk-chapter-size` / `bulk-series-size` — discloses file sizes of libraries the user cannot access
- Affected
- <= 0.9.0.2
- Patched in
- 0.9.1
- lowGHSA-6cpx-c6v4-4g79Sep 5, 2026reading-list items endpoint returns another user's private list, skipping the ownership check its siblings enforce
- Affected
- 0.9.0
- Patched in
- 0.9.1
- mediumGHSA-j48q-94cr-7hq5Sep 5, 2026Missing admin authorization on theme upload/delete/download lets any user inject or remove global CSS themes (CWE-862)
- Affected
- <= 0.9.0.2
- Patched in
- 0.9.1
- mediumGHSA-8qw5-fgxm-ppjjSep 5, 2026IDOR in POST /api/collection/update-series allows any user to remove series from / delete another user's collection (CWE-639)
- Affected
- <= 0.9.0.2
- Patched in
- 0.9.1
- mediumGHSA-fpjf-pxrq-4xv7Sep 5, 2026IDOR in DELETE /api/filter allows any user to delete another user's Smart Filter (CWE-639)
- Affected
- <= 0.9.0.2
- Patched in
- 0.9.1
- lowGHSA-jhw9-5hj3-mvp4Sep 5, 2026IDOR in dashboard/side-nav stream update lets any user toggle another user's widget visibility (CWE-639)
- Affected
- <= 0.9.0.2
- Patched in
- 0.9.1
- mediumGHSA-gjx7-m655-3grwSep 5, 2026Annotation read endpoints filter only by self-selected social preferences and skip the library-access and age-restriction checks
- Affected
- <= 0.9.0.2
- Patched in
- 0.9.1
- criticalCVE-2026-47202May 19, 2026Pre-Auth Account Takeover
- Affected
- <= 0.9.0
- Patched in
- 0.9.0.2
- mediumCVE-2026-44775May 5, 2026GitHub Security Lab (GHSL) Vulnerability Report, Kavita: `GHSL-2026-068`
- Affected
- <=v0.8.9.1
- mediumCVE-2026-44776May 5, 2026# GitHub Security Lab (GHSL) Vulnerability Report, Kavita: `GHSL-2026-033`
- Affected
- <v0.8.9.1
- lowCVE-2024-39307Jun 28, 2024Cross-Site-Scripting vulnerability via crafted ebooks
- Affected
- < 0.8.0