EUVD-2026-62484Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable POST endpoint; low privilege reflects self-registerable (even unactivated) account access; no scope change; high C/I/A for credential theft, config overwrite, and service disruption.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.admin_user property, unlike the corresponding GET handler. Any authenticated regular user can therefore overwrite server configuration values including SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. The process_auth_header function in webserver/handlers/base.py also fails to verify the matched account's active flag, allowing a registered but unactivated account to authenticate and reach the vulnerable handler. Exploitation can disclose secrets through configuration access paths, sabotage application behavior, force service restarts, and supply the settings needed for related code-injection attacks. This issue is fixed in version 3.42.0.
AnalysisAI
Missing authorization in MyBooks (Talebook) 3.41.2 and earlier allows any authenticated low-privilege user - including holders of unactivated accounts - to overwrite server-side configuration through the POST /api/admin/settings endpoint, exposing SMTP credentials, OAuth client secrets, storage paths, and security feature flags to unauthorized modification. Two compounding flaws are present: the AdminSettings.post handler in webserver/handlers/admin.py applies only the authentication decorator without the admin_user check enforced by its GET counterpart, and process_auth_header in webserver/handlers/base.py accepts sessions for registered-but-unactivated accounts by not verifying the user.active flag. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a session authenticated against the MyBooks instance - either a fully active low-privilege account or a registered-but-unactivated account, because process_auth_header does not check the user.active flag. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and accurately reflects the threat: network-reachable, low complexity, requiring only low-privilege authentication, with high impact across confidentiality, integrity, and availability of the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to MyBooks (Talebook) version 3.42.0, available at https://github.com/PoxenStudio/mybooks/releases/tag/3.42.0, which resolves all three fix points: the missing admin_user check in AdminSettings.post, the missing active-flag check in process_auth_header, and the configuration key injection surface in loader.py. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running MyBooks (Talebook) 3.41.2 or earlier and assess their exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and e
Registration bypass and authentication bypass in Talebook (MyBooks) 3.41.2 and earlier allow an unauthenticated remote a
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today