The vulnerability lies in Audiobookshelf's collection API. The GET /api/collections and GET /api/collections/:id endpoints return all collections regardless of which libraries each collection belongs to. Because the endpoints skip the access‑control check, an authenticated user who has access to any library can enumerate and read collections, including full book metadata, from libraries the user is not authorized to view. This results in the disclosure of potentially sensitive metadata. The weakness is rooted in missing authorization checks (CWE‑863).

The affected product is Audiobookshelf by advplyr, which is distributed as a self‑hosted audiobook and podcast server. Versions before 2.32.2 are vulnerable; all releases up to and including 2.32.1 lack the fix.

The CVSS score of 4.3 indicates moderate risk. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Because an attacker only needs to be a legitimate authenticated user with any library access, the exploitation effort is low. The most likely attack vector is an internal user or compromised account that can enumerate collections across all libraries.