PatchTheCVECVE-2021-3986: A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belongi
CVE-2021-3986 is a medium-severity flaw (CVSS 4.3) affecting calibre-web. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 69%) |
| CISA exploited list | No |
| Weakness | CWE-209 |
| Published | 2024-11-15 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-3986?
calibre-web: upgrade to 0.6.15. Exact commands for each OS are on this page.
Is CVE-2021-3986 being exploited?
CVE-2021-3986 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-3986 affect?
CVE-2021-3986 affects calibre-web. Severity is medium (CVSS 4.3). A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message
How urgent is CVE-2021-3986?
Priority 28/100. Public exploit reference
Related CVEs
- CVE-2025-7404 CRITICAL 9.8 DOWNGRADE DOWNGRADE Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ca
- CVE-2025-65858 LOW 3.5 DOWNGRADE A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious
- CVE-2024-39123 MEDIUM 5.4 UPGRADE In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting
- CVE-2021-3988 MEDIUM 6.1 UPGRADE A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_book
- CVE-2021-3987 MEDIUM 4.3 UPGRADE An improper access control vulnerability exists in janeczku/calibre-web