CVE-2026-86041

Received Received - Intake

IP Spoofing via X-Forwarded-For in ezBookkeeping

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-86041

Affected Vendors & Products

Vendor	Product	Version / Range
mayswind	ezbookkeeping	>= 0.10.0, < 1.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-348	The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

Executive Summary

This vulnerability affects ezBookkeeping, a self-hosted finance app. It occurs because the router is set up without proper proxy trust settings. This allows attackers to spoof their IP address using the X-Forwarded-For header. The spoofed IP bypasses IP-based access controls but does not bypass authentication tokens.

Detection Guidance

Check if your ezBookkeeping instance is running a version between 0.10.0 and 1.6.0. Inspect server logs for requests with X-Forwarded-For headers containing allowlisted IP addresses. Look for mismatches between the actual client IP and the IP recorded in Transaction.CreatedIp or logs.

Impact Analysis

An attacker could make requests appear to come from a trusted IP address, masking their true origin. This could lead to unauthorized actions being logged under a trusted IP, complicating forensic analysis. However, a valid token is still required for protected actions.

Compliance Impact

This vulnerability could impact compliance by obscuring the true origin of actions in logs, making it difficult to trace unauthorized activities. This may violate audit requirements in GDPR and HIPAA, which mandate accurate logging and accountability.

Mitigation Strategies

Upgrade ezBookkeeping to version 1.6.0 or later immediately. If upgrading is not possible, manually configure SetTrustedProxies in the Gin router to restrict trusted proxies and prevent IP spoofing via X-Forwarded-For headers.

Hi! I’m here to help you understand CVE-2026-86041. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...