Signalcrest
← Back to feed
devtosecurity

🐛 The bug: Improper Access Control (IDOR) in Calibre-Web

Calibre-Web has access control bug

Steady

7

signal score

→ Steady

7-day est. ~4

ShareLinkedInOpen source ↗

Why this scored 7

every term, weighted
Velocity+0.1 / 40 max

Engagement per hour, normalized against the fastest item on its own source

Acceleration+0.0 / 25 max

Whether that velocity is itself speeding up, as a per-hour rate

Cross-source spread+0.0 / 25 max

How many independent communities are talking about the same entity

Recency+8.0 / 10 max

Decays to zero over 14 days

Saturation penalty−0.6 / 30 max

Subtracted once something is big and old — we rank what's next, not what's peaked

Composite7.5

Weights are hand-tuned, not learned — we're calibrating them against realized trends as history accumulates. On a topic's first sighting there's no previous reading to compare against, so acceleration starts from a neutral prior rather than a measurement. Full methodology

Outlook

low confidence · estimate, not a guarantee

7-day

~4

range 4–4

14-day

~3

range 3–3

30-day

~3

range 3–3

Signal history

7-day window (free)

— — projected trajectory (estimate, not a guarantee)

Entities

calibreweb
Embed a live signal badge
Signalcrest signal badge
[![Signalcrest signal](https://www.signalcrest.app/api/badge/dev%3A4314897)](https://www.signalcrest.app/topic/dev%3A4314897)

Drop this in a README or blog post — it updates automatically as the score moves.