MyBooks CVE-2026-45273

Exploitation requires the attacker to possess a session authenticated against the MyBooks instance - either a fully active low-privilege account or a registered-but-unactivated account, because process_auth_header does not check the user.active flag. On instances where ALLOW_REGISTER is true (or not explicitly set to false), an attacker can self-register and exploit the authentication bypass without any prior credential. On instances with registration disabled, the attacker must hold at minimum a valid low-privilege user credential. The vulnerable endpoint is specifically POST /api/admin/settings; read-only access (GET) is correctly restricted by the admin_user check. Exploitation is limited to MyBooks/Talebook versions 3.41.2 and earlier. Instances with the POST endpoint blocked at a reverse proxy, or with no external-facing user registration and no low-privilege users, have substantially reduced exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and accurately reflects the threat: network-reachable, low complexity, requiring only low-privilege authentication, with high impact across confidentiality, integrity, and availability of the vulnerable system. The secondary authentication-bypass flaw (inactive accounts accepted by process_auth_header) effectively reduces the privilege requirement in practice - on instances with open registration, an attacker needs no prior relationship with the target to obtain a usable session. Scope is confined to the application itself (SC/SI/SA:N), with no lateral movement beyond the web server's own configuration. No EPSS data was provided in the intelligence, and the vulnerability is not listed in CISA KEV, so broad automated exploitation has not been confirmed. However, the low attack complexity and high configuration-write impact make this a realistic priority for any internet-exposed instance: an attacker who overwrites SMTP or OAuth credentials obtains secrets, and the loader.py fix confirms a path toward code injection via configuration key injection. Risk is elevated for deployments with open user registration enabled, and reduced for instances behind authenticated reverse proxies or with registration disabled.

An attacker visits an internet-exposed MyBooks instance, registers a new account (if registration is enabled), and immediately uses that unactivated account to authenticate - bypassing the active-flag check in process_auth_header. The attacker then POSTs a crafted JSON body to /api/admin/settings, overwriting SMTP server credentials or OAuth client secrets, which are then readable through normal configuration access paths. With control over configuration values, the attacker may also inject malicious strings into configuration key names to achieve code execution via the unpatched loader.py key-formatting flaw present in versions prior to 3.42.0. No public POC has been identified, but the attack requires only two HTTP requests and no specialized tooling.