starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: Server - User authorization is ignored #3107

New Issue
Closed
opened 2026-04-25 00:13:42 +02:00 by adam · 4 comments
adam commented 2026-04-25 00:13:42 +02:00
Owner
Copy Link
Copy Source

Originally created by @rrwright on GitHub (Nov 22, 2025).

What happened?

Any user can access any library. There appears to be no server-side authorization at all. A client that authenticates to the server is granted access to all libraries on that server, regardless of whether that user had limited permissions.

What did you expect to happen?

The server must enforce access limitations to users and not rely on clients to limit user access.

Steps to reproduce the issue

  1. Create multiple libraries.
  2. Create a user with account type "user" and give them access to one library, but remove access for the other library
  3. Sign in with that user.
  4. The server allows the auth token from that user to access all libraries and all of their contents, even for libraries that user is not supposed to have access to.

Audiobookshelf version

x2.29.0

How are you running audiobookshelf?

Built from source

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

Other (list in "Additional Notes" box)

Logs

Additional Notes

Tested with API calls and custom client.

Originally created by @rrwright on GitHub (Nov 22, 2025). ### What happened? Any user can access any library. There appears to be no server-side authorization at all. A client that authenticates to the server is granted access to all libraries on that server, regardless of whether that user had limited permissions. ### What did you expect to happen? The server must enforce access limitations to users and not rely on clients to limit user access. ### Steps to reproduce the issue 1. Create multiple libraries. 2. Create a user with account type "user" and give them access to one library, but remove access for the other library 3. Sign in with that user. 4. The server allows the auth token from that user to access all libraries and all of their contents, even for libraries that user is not supposed to have access to. ### Audiobookshelf version x2.29.0 ### How are you running audiobookshelf? Built from source ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? Other (list in "Additional Notes" box) ### Logs ```shell ``` ### Additional Notes Tested with API calls and custom client.
adam added the bug label 2026-04-25 00:13:42 +02:00
adam closed this issue 2026-04-25 00:13:42 +02:00
adam commented 2026-04-25 00:13:42 +02:00
Author
Owner
Copy Link
Copy Source

@nichwall commented on GitHub (Nov 22, 2025):

I'm not able to reproduce this with the web client with a newly created test user. I am not able to test with the API directly at the moment, are you sure you are using the correct API key?

@nichwall commented on GitHub (Nov 22, 2025): I'm not able to reproduce this with the web client with a newly created test user. I am not able to test with the API directly at the moment, are you sure you are using the correct API key?
adam commented 2026-04-25 00:13:42 +02:00
Author
Owner
Copy Link
Copy Source

@rrwright commented on GitHub (Nov 23, 2025):

I have a repro in a custom app able to reproduce this, but it's also experiencing some other complications. I'll try to verify with a standalone script and upload the script if I'm able to reproduce it independently. Will file a new issue then.

@rrwright commented on GitHub (Nov 23, 2025): I have a repro in a custom app able to reproduce this, but it's also experiencing some other complications. I'll try to verify with a standalone script and upload the script if I'm able to reproduce it independently. Will file a new issue then.
adam commented 2026-04-25 00:13:42 +02:00
Author
Owner
Copy Link
Copy Source

@rrwright commented on GitHub (Nov 25, 2025):

This was a local bug, not a server bug. Apologies for the fire drill! And thanks for taking a quick look.

@rrwright commented on GitHub (Nov 25, 2025): This was a local bug, not a server bug. Apologies for the fire drill! And thanks for taking a quick look.
adam commented 2026-04-25 00:13:42 +02:00
Author
Owner
Copy Link
Copy Source

@nichwall commented on GitHub (Nov 25, 2025):

This was a local bug, not a server bug. Apologies for the fire drill! And thanks for taking a quick look.

Thanks for confirming. :)

@nichwall commented on GitHub (Nov 25, 2025): > This was a local bug, not a server bug. Apologies for the fire drill! And thanks for taking a quick look. Thanks for confirming. :)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3107
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?