This vulnerability arises from a missing authentication check in the admin endpoint implementation within the cps/cwa_functions.py module of Calibre-Web-Automated. The flaw allows an attacker to invoke privileged functionality without credentials, effectively bypassing authentication. As a result, an adversary can gain unauthorized access to the administrative interface and potentially manipulate configuration, data, or execute arbitrary actions on the host.

The affected product is Calibre-Web-Automated by crocodilestick, versions up to and including 4.0.6. No other versions or components are listed as vulnerable in the current advisory.

The CVSS score of 6.9 indicates a moderate impact. No EPSS score is available, but the advisory notes that the exploit has been published and can be triggered remotely, suggesting that adversaries with internet exposure to the service could leverage this flaw. The vulnerability is not currently listed in CISA’s KEV catalog, implying no confirmed large‑scale exploitations documented. Attackers would target the exposed admin endpoint over HTTP/HTTPS, following standard web exploitation procedures. The lack of authentication is the key vector.