CVE-2022-0406: Incorrect Authorization (CWE-863)
value: Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.3
Published: 2022-04-03T19:15Z
Repository: https://github.com/janeczku/calibre-web
Language: Python
Files changed: SECURITY.md, cps/constants.py
Commit date: 2022-01-24 19:18:40 +0100
Commit message: Upates for new release

Diff: diff --git a/SECURITY.md b/SECURITY.md
index c6f866073..3e5a965dd 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -27,10 +27,13 @@ To receive fixes for security vulnerabilities it is required to always upgrade t
 | V 0.6.14      | Migrated some routes to POST-requests (CSRF protection). Thanks to @scara31                                        ||
 | V 0.6.15      | Fix for "javascript:" script links in identifier. Thanks to @scara31                                               ||
 | V 0.6.15      | Cross-Site Scripting vulnerability on uploaded cover file names. Thanks to @ibarrionuevo                           ||
 | V 0.6.15      | Creating public shelfs is now denied if user is missing the edit public shelf right. Thanks to @ibarrionuevo       ||
 | V 0.6.15      | Changed error message in case of trying to delete a shelf unauthorized. Thanks to @ibarrionuevo                    ||
+| V 0.6.16      | JavaScript could get executed on authors page. Thanks to @alicaz                                                   ||
+| V 0.6.16      | Localhost can no longer be used to upload covers. Thanks to @scara31                                               ||
+| V 0.6.16      | Another case where public shelfs could be created without permission is prevented. Thanks to @ibarrionuevo         ||
 
 
 ## Staement regarding Log4j (CVE-2021-44228 and related)
 
 Calibre-web is not affected by bugs related to Log4j. Calibre-Web is a python program, therefore not using Java, and not using the Java logging feature log4j. 
diff --git a/cps/constants.py b/cps/constants.py
index 7fb973fc3..281517cc4 100644
--- a/cps/constants.py
+++ b/cps/constants.py
@@ -149,11 +149,11 @@ def selected_roles(dictionary):
 
 # :rtype: BookMeta
 BookMeta = namedtuple('BookMeta', 'file_path, extension, title, author, cover, description, tags, series, '
                                   'series_id, languages, publisher')
 
-STABLE_VERSION = {'version': '0.6.16 Beta'}
+STABLE_VERSION = {'version': '0.6.16'}
 
 NIGHTLY_VERSION = {}
 NIGHTLY_VERSION[0] = '$Format:%H$'
 NIGHTLY_VERSION[1] = '$Format:%cI$'
 # NIGHTLY_VERSION[0] = 'bb7d2c6273ae4560e83950d36d64533343623a57'

Vulnerable code: STABLE_VERSION = {'version': '0.6.16 Beta'}
Fixed code: | V 0.6.16      | JavaScript could get executed on authors page. Thanks to @alicaz                                                   ||
| V 0.6.16      | Localhost can no longer be used to upload covers. Thanks to @scara31                                               ||
| V 0.6.16      | Another case where public shelfs could be created without permission is prevented. Thanks to @ibarrionuevo         ||
STABLE_VERSION = {'version': '0.6.16'}