CVE-2026-45273
Received Received - Intake

MyBooks Admin Configuration Overwrite via Auth Bypass

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.admin_user property, unlike the corresponding GET handler. Any authenticated regular user can therefore overwrite server configuration values including SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. The process_auth_header function in webserver/handlers/base.py also fails to verify the matched account's active flag, allowing a registered but unactivated account to authenticate and reach the vulnerable handler. Exploitation can disclose secrets through configuration access paths, sabotage application behavior, force service restarts, and supply the settings needed for related code-injection attacks. This issue is fixed in version 3.42.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-45273
EUVD
EUVD-2026-62484

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mybooks mybooks to 3.42.0 (exc)
mybooks mybooks 3.42.0
poxenstudio mybooks to 3.42.0 (exc)
poxenstudio talebook to 3.42.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45273 is a privilege escalation vulnerability in MyBooks (also known as Talebook) versions 3.41.2 and earlier. The POST /api/admin/settings endpoint lacks proper admin role checks, allowing any authenticated user to overwrite server configuration values like SMTP credentials, OAuth secrets, and storage paths. Additionally, the authentication system does not verify if accounts are activated, enabling unconfirmed users to exploit the flaw.

Detection Guidance

Check if your MyBooks instance is running version 3.41.2 or earlier. Inspect network traffic for POST requests to /api/admin/settings from non-admin accounts. Review server logs for unauthorized configuration changes or access to sensitive settings.

Impact Analysis

An attacker could exploit this to read sensitive configuration data, modify server settings to disrupt service, force restarts, or enable further attacks like remote code execution. This could lead to credential theft, data breaches, or unauthorized system access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade to MyBooks version 3.42.0 or later. Ensure the AdminSettings.post handler includes an admin_user check. Verify process_auth_header validates the active flag for all accounts. Restrict access to the /api/admin/settings endpoint to admin users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart