Calibre-Web-Automated v4.0.7 is out with four access-control fixes, and the release notes put the update request in bold. CWA is the self-hosted wrapper around Calibre-Web that watches an ingest folder and files the books for you; if yours answers beyond the LAN, this is a this-week update.
The four holes
The Kobo side had the worst of it: any logged-in user could create, view or delete another user’s Kobo sync token, and use that token to sign in a device as its owner. Tokens are now owner-or-admin only. The service pages (Convert Library, the EPUB Fixer, their start, cancel and status endpoints, the log viewer and downloads) were reachable without a login, and now require an admin account. CWA’s internal service endpoints, the /cwa-internal/* calls its own background services use, could be reached from outside by spoofing a request header; they now demand a shared secret only CWA’s own processes can read. And the single-book EPUB fixer, which guests could reach when anonymous browsing is enabled, now checks for edit rights.
No CVE numbers, and no sign of exploitation. These matter most on shared instances: a family library where everyone has an account, or any setup that answers beyond the LAN.
Speed, and the rest
Kobo sync is the performance story: reading-state handling and metadata loading were rewritten to avoid per-book queries, which the notes measure at up to roughly 15 seconds saved per sync request on large libraries. KEPUB conversion now happens on demand at download time; opening the Kobo token page used to convert every EPUB in the library. Reading progress now syncs across copies and formats of the same book, because it is stored against the Calibre book rather than the file checksum, and KOReader progress is mirrored to Hardcover.
Smaller items fill out the list: a database deadlock between cover thumbnails and metadata saves that could freeze the web UI, intermittent 500s on pages that rendered after their database session closed, a healthcheck that followed a redirect into false alarms. All fixed. Covers now sit in a 2:3 frame, cropped instead of stretched; the phone layout moves to three columns with a one-row sort bar; and the login page is a single card with matching SSO, GitHub, Google and magic-link buttons. OPDS feeds expose custom columns, and Magic Shelves gain a Currently Reading template.
Before you upgrade
Two upgrade notes, both one-time. Run a full scan from the Duplicates page, to build the index the new incremental duplicate tracking reads. And if you see permission errors editing or deleting books, fix the ownership of root-owned strays once: the ingest service now drops root and runs as abc (your PUID/PGID), so imported books land owned by the same user as the web app.
My read
The four holes are the kind a shared instance acquires quietly: everyone has a login, the pages look ordinary, nothing seems broken. The bold update request is the right call: they were fixed before anyone had to notice them. The Kobo rewrite is the reason not to wait: same pull, up to fifteen seconds a request. Run the one-time duplicates scan, fix ownership if the logs ask, and that is the whole of it.
Source: the v4.0.7 release notes.