CVE-2024-6782: Calibre content server improper access control leading to unauthenticated RCE
The short version: Calibre — the popular e-book manager — has an improper-access-control flaw (CVE-2024-6782) in its content server that lets an unauthenticated attacker reach privileged functionality and run code on the host. It scores 9.8 and a public exploit exists. It's not in CISA's KEV catalog, and Calibre's content server isn't usually enterprise-exposed — but where it is reachable, this is patch-now. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE, but limited exposure (Calibre's server is rarely internet-facing at scale) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 83.39% · 99.65th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in CISA KEV; a public exploit / advisory exists (STAR Labs) |
| Vulnerability type | CWE-863 improper authorization → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Calibre 6.9.0 through 7.14.0 |
| Fixed in | A subsequent Calibre release — upgrade to the latest version (see STAR Labs advisory) |
What you need to know
CVE-2024-6782 is an improper access control flaw in the Calibre content server — the optional feature that lets you browse and manage your library over the network. Because the server fails to properly restrict access to privileged functionality, an unauthenticated attacker can reach operations they shouldn't and chain them into remote code execution on the machine running Calibre.
Worth being precise about scope:
- It's the content server, not the desktop app. You're only exposed if you run Calibre's built-in server and it's reachable by an attacker.
- It's pre-authentication. Where the server is reachable, no login is required.
- A public exploit exists, which is why the EPSS is high — but it is not in CISA KEV.
How serious we see it
High — serious mechanics, tempered by realistic exposure.
Unauthenticated RCE always earns respect, and the 9.8 describes the mechanism accurately. We land at High rather than Critical because Calibre's content server is typically run by individuals or on internal networks, not exposed as internet-facing enterprise infrastructure — and it's not in KEV. Where a content server is reachable, though, treat it as urgent. The reassuring part: it affects a specific version range, upgrading resolves it, and confirming whether you run the server at all is quick.
Recommendations
Straight from the researcher's advisory and Calibre's release notes:
- Upgrade Calibre. Move to a release later than 7.14.0 — the current version resolves this.
- Confirm your exposure first. Determine whether you run the Calibre content server and whether it's reachable beyond localhost.
- Don't expose the content server. Bind it to trusted networks or put it behind a VPN or authenticating reverse proxy; never leave it open to the internet.
- Hunt if it was exposed. Review logs for unexpected requests to the content server and any anomalous process execution.
How BreachRisk sees it
BreachRisk discovers internet-facing Calibre content servers from little more than your domain and fingerprints the product and version, flagging exposure tied to this CVE. For a version-based flaw we detect and flag; we don't exploit it. The point is surfacing a forgotten, internet-reachable content server as a ranked finding — the kind of stray service that appears when someone stands one up and never takes it down.