CVE-2026-0616

TheLibrarians web_fetch tool can be used to retrieve the Adminer interface content, which can then be used to log into the internal TheLibrarian backend system. The vendor has fixed the vulnerability in all affected versions.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mindgard.ai/blog/thelibrarian-ios-ai-security-disclosure	Third Party Advisory
https://thelibrarian.io/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:thelibrarian:the_librarian:-:*:*:*:*:*:*:*

History

17 Jun 2026, 10:11

Type	Values Removed	Values Added
Summary		(es) La herramienta web_fetch de TheLibrarians puede usarse para recuperar el contenido de la interfaz de Adminer, que luego puede usarse para iniciar sesión en el sistema de backend interno de TheLibrarian. El proveedor ha corregido la vulnerabilidad en todas las versiones afectadas.

23 Jan 2026, 16:59

Type	Values Removed	Values Added
References	~~() https://mindgard.ai/blog/thelibrarian-ios-ai-security-disclosure -~~	() https://mindgard.ai/blog/thelibrarian-ios-ai-security-disclosure - Third Party Advisory
References	~~() https://thelibrarian.io/ -~~	() https://thelibrarian.io/ - Product
First Time		Thelibrarian Thelibrarian the Librarian
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:a:thelibrarian:the_librarian:-:::::::*

16 Jan 2026, 22:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

16 Jan 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-16 13:16

Updated : 2026-06-17 10:11

NVD link : CVE-2026-0616

Mitre link : CVE-2026-0616

CVE.ORG link : CVE-2026-0616

JSON object : View

Products Affected

thelibrarian

the_librarian

CWE

NVD-CWE-noinfo

{"id": "CVE-2026-0616", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0616", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T21:39:40.680029Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "TheLibrarian", "product": "TheLibrarian.io", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0"}]}]}], "published": "2026-01-16T13:16:11.960", "references": [{"url": "https://mindgard.ai/blog/thelibrarian-ios-ai-security-disclosure", "tags": ["Third Party Advisory"], "source": "cret@cert.org"}, {"url": "https://thelibrarian.io/", "tags": ["Product"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "TheLibrarians web_fetch tool can be used to retrieve the Adminer interface content, which can then be used to log into the internal TheLibrarian backend system. The vendor has fixed the vulnerability in all affected versions."}, {"lang": "es", "value": "La herramienta web_fetch de TheLibrarians puede usarse para recuperar el contenido de la interfaz de Adminer, que luego puede usarse para iniciar sesi\u00f3n en el sistema de backend interno de TheLibrarian. El proveedor ha corregido la vulnerabilidad en todas las versiones afectadas."}], "lastModified": "2026-06-17T10:11:05.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thelibrarian:the_librarian:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE8F0743-241A-47D8-B16A-8E3B94C6ABB8"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}