The Kavita ReaderController.GetImage endpoint was marked AllowAnonymous, allowing any client to request chapter images without authentication. The apiKey parameter given in the request was never checked, so an attacker could simply specify any integer ID and retrieve the corresponding image. Because entity identifiers are sequential, enumeration of all content on the server becomes trivial, leading to full disclosure of media assets and potential brand or proprietary information.

Kareadita’s Kavita reading server, versions prior to 0.9.0, is affected. The vulnerability resides in the cross‑platform Reader API that serves images from any library the server hosts.

The CVSS score of 6.9 indicates moderate severity, with no EPSS score available and the vulnerability not listed in CISA KEV. The attack vector is remote network access to the /api/Reader/image endpoint, requiring no special credentials; enumeration of all image content is effectively immediate once access is gained.