Talebook CVE-2026-45274

Exploitation requires that the target Talebook instance has public registration disabled by the administrator (ALLOW_REGISTER set to false or absent), which is precisely the configuration the vulnerability bypasses. Instances where ALLOW_REGISTER is true and registration is open are not meaningfully affected, since a legitimate registration path already exists. The instance must be network-reachable by the attacker - no authentication is required, and no specific client software beyond a standard HTTP tool is needed. Exploitation is limited to gaining a standard low-privilege user account; administrative access is not obtained through this vulnerability alone. The second component (active-flag bypass) also requires that the Talebook instance uses an email-activation or account-activation workflow; instances with activation disabled would not benefit from the process_auth_header fix but are also not further harmed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, unauthenticated exploitation with no attack requirements, which is the highest-severity attack surface configuration. The base score of 6.9 reflects limited downstream impact (VC:L/VI:L/VA:N) - the attacker gains a low-privilege account, not administrator access. The primary real-world risk is as a prerequisite for chained exploitation: the CVE description explicitly notes the bypass 'can supply the low-privilege account required by related authorization vulnerabilities,' meaning its practical severity depends heavily on what other privilege-escalation or data-access flaws exist in the same Talebook instance. EPSS data was not provided in the input; exploitation probability cannot be quantified from available signals. No CISA KEV listing exists, and no public exploit code has been identified, suggesting opportunistic mass exploitation is not currently occurring. Because Talebook is a self-hosted, niche ebook server with a relatively small deployment base, aggregate exposure is limited - even a small operator running an unpatched public-facing instance faces meaningful policy violation risk since the administrator's explicit intent (closed registration) is silently defeated.

An attacker identifies a publicly exposed Talebook instance where the administrator has disabled open registration (ALLOW_REGISTER=false). The attacker sends a direct POST request to /api/user/sign_up with valid registration parameters, bypassing the frontend entirely; the server creates the account without checking the flag. The attacker immediately authenticates with the new account - without completing any email activation - and gains access to user-level API endpoints, which may be exploited further via related authorization vulnerabilities in the same instance.