EUVD-2026-62485Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint with no complexity; impact limited to low-privilege account creation and access, no availability or scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handlers/user.py does not enforce the ALLOW_REGISTER configuration flag, even though the frontend hides registration controls when the flag is false. An unauthenticated remote attacker can call the endpoint directly and create a valid account on an instance whose administrator disabled public registration. The process_auth_header function in webserver/handlers/base.py also does not verify the account's active flag, so the newly created and unactivated account can authenticate immediately and access user-level API functionality. The bypass defeats the intended account-creation policy and can supply the low-privilege account required by related authorization vulnerabilities. This issue is fixed in version 3.42.0.
AnalysisAI
Registration bypass and authentication bypass in Talebook (MyBooks) 3.41.2 and earlier allow an unauthenticated remote attacker to create accounts on instances where the administrator has disabled public registration, and then immediately authenticate with those unactivated accounts to access user-level API functionality. The root cause is a server-side enforcement gap: the POST /api/user/sign_up handler in user.py ignores the ALLOW_REGISTER configuration flag entirely, relying on the frontend to suppress the UI - a classic CWE-602 client-side enforcement failure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Talebook instance has public registration disabled by the administrator (ALLOW_REGISTER set to false or absent), which is precisely the configuration the vulnerability bypasses. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, unauthenticated exploitation with no attack requirements, which is the highest-severity attack surface configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Talebook version 3.42.0, which contains the confirmed fix for both the ALLOW_REGISTER enforcement gap and the active-flag bypass in process_auth_header. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and e
Missing authorization in MyBooks (Talebook) 3.41.2 and earlier allows any authenticated low-privilege user - including h
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today