The flaw is in a subscription‑check endpoint that accepted a client‑supplied Stripe Checkout Session ID without confirming that the session belonged to the caller. By replaying a valid paid Session ID the attacker could grant a paid plan to any authenticated free account, effectively hijacking entitlements and enabling unauthorized access to premium content. This is an authorization bypass reflected in CWE‑639.

Users running Readest prior to version 0.11.10 on the Readest application are affected. The vulnerable code resides in the POST /api/stripe/check route in the readest‑app component.

The CVSS score of 6.5 indicates a moderate severity. The vulnerability is exploitable remotely via a web request that an authenticated user can craft. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, but the impact on subscription integrity is significant because any user can inflate accounts without payment.