starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: All Ereader Devices visible to non-admin user #2916

New Issue
Closed
opened 2026-04-25 00:11:49 +02:00 by adam · 2 comments
adam commented 2026-04-25 00:11:49 +02:00
Owner
Copy Link
Copy Source

Originally created by @laustindasauce on GitHub (Jul 24, 2025).

What happened?

A non-admin/root user type is able to access all Ereader Devices stored on the application. This access is read-only but still potentially problematic.

What did you expect to happen?

If a user isn't admin/root, they should never have the ability to see other user's registered Ereader Devices.

Steps to reproduce the issue

  1. Login to a standard user (non-admin/root) account that has the 'Can Create Ereader' permission enabled.
  2. Change the password for the user on the Account page.
  3. Immediately create a new Ereader Device after changing the password.
  4. Go to the Home page.
  5. Click back on your profile to go to the Account page.
  6. Until a refresh is performed, the user will see all Ereader Devices inside the 'Ereader Devices' table.

Audiobookshelf version

v2.26.3

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

Chrome

Logs

Additional Notes

This was first experienced with Safari on IOS but was able to reproduce in Chrome.

Originally created by @laustindasauce on GitHub (Jul 24, 2025). ### What happened? A non-admin/root user type is able to access all Ereader Devices stored on the application. This access is read-only but still potentially problematic. ### What did you expect to happen? If a user isn't admin/root, they should never have the ability to see other user's registered Ereader Devices. ### Steps to reproduce the issue 1. Login to a standard user (non-admin/root) account that has the 'Can Create Ereader' permission enabled. 2. Change the password for the user on the Account page. 3. Immediately create a new Ereader Device after changing the password. 4. Go to the Home page. 5. Click back on your profile to go to the Account page. 6. Until a refresh is performed, the user will see **all** Ereader Devices inside the 'Ereader Devices' table. ### Audiobookshelf version v2.26.3 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? Chrome ### Logs ```shell ``` ### Additional Notes This was first experienced with Safari on IOS but was able to reproduce in Chrome.
adam added the bug label 2026-04-25 00:11:49 +02:00
adam closed this issue 2026-04-25 00:11:49 +02:00
adam commented 2026-04-25 00:11:49 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Jul 25, 2025):

Nice find! Changing the password isn't necessary. Just make any change to an e-reader and it will trigger the socket event that is returning all devices.

@advplyr commented on GitHub (Jul 25, 2025): Nice find! Changing the password isn't necessary. Just make any change to an e-reader and it will trigger the socket event that is returning all devices.
adam commented 2026-04-25 00:11:50 +02:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Aug 3, 2025):

Fixed in v2.27.0.

@github-actions[bot] commented on GitHub (Aug 3, 2025): Fixed in [v2.27.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.27.0).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2916
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?