From aef33df8d338aa14a5db02b0353e8461796a392a Mon Sep 17 00:00:00 2001 From: advplyr Date: Tue, 22 Sep 2026 17:49:53 -0500 Subject: [PATCH] Update get series for library endpoint to ensure series belongs to library --- server/controllers/LibraryController.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/controllers/LibraryController.js b/server/controllers/LibraryController.js index 07c1d276a..6bf36a7b4 100644 --- a/server/controllers/LibraryController.js +++ b/server/controllers/LibraryController.js @@ -782,7 +782,7 @@ class LibraryController { .filter((v) => !!v) const series = await Database.seriesModel.findByPk(req.params.seriesId) - if (!series) return res.sendStatus(404) + if (!series || series.libraryId !== req.library.id) return res.sendStatus(404) const libraryItemsInSeries = await libraryItemsBookFilters.getLibraryItemsForSeries(series, req.user)