The vulnerability in Audiobookshelf’s bulk‑download endpoint allows an authenticated user with download permission to request any file by its ID, regardless of the library to which the user belongs. The result is that the user can read full file contents from libraries to which they are explicitly denied access, leading to confidential data exposure. The weakness is an access‑control flaw (CWE‑863).

All installations of the advplyr Audiobookshelf service running versions earlier than 2.32.2 are affected. The issue resides in the GET /api/libraries/:id/download endpoint that does not constrain downloaded items to the library in the path.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and possess download permission, but once these prerequisites are met a simple crafted HTTP GET request will retrieve any file, making exploitation straightforward and low‑effort.