CVE-2026-45273 in Talebook
Summary
by MITRE • 08/19/2026
MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.admin_user property, unlike the corresponding GET handler. Any authenticated regular user can therefore overwrite server configuration values including SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. The process_auth_header function in webserver/handlers/base.py also fails to verify the matched account's active flag, allowing a registered but unactivated account to authenticate and reach the vulnerable handler. Exploitation can disclose secrets through configuration access paths, sabotage application behavior, force service restarts, and supply the settings needed for related code-injection attacks. This issue is fixed in version 3.42.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in MyBooks, also known as Talebook, represents a critical authentication bypass and authorization flaw within its web server implementation, specifically affecting versions up to 3.41.2. The core of the issue lies in the AdminSettings.post handler located at POST /api/admin/settings within the file webserver/handlers/admin.py. While this endpoint is protected by an auth decorator intended to restrict access to administrative functions, it fails to perform a secondary verification step that checks if the authenticated user possesses the self.admin_user property. This oversight creates a significant discrepancy when compared to the corresponding GET handler for admin settings, which correctly enforces strict administrative privileges. Consequently, any user who can successfully authenticate against the application is granted the ability to modify critical server configuration values without possessing actual administrator rights.
The severity of this vulnerability is compounded by deficiencies in the underlying authentication logic found in webserver/handlers/base.py within the process_auth_header function. This component fails to verify the active flag associated with a matched user account during the authentication process. As a result, registered accounts that have not yet been activated or verified are still permitted to authenticate and access protected endpoints. When combined with the authorization flaw in the admin settings handler, this allows an attacker using a simple unactivated regular user account to bypass security controls entirely. This dual failure effectively reduces the required privilege level for exploitation from administrator to any registered user, including those who have not completed their registration process.
The operational impact of exploiting this vulnerability is extensive and potentially catastrophic for the integrity and confidentiality of the MyBooks deployment. An attacker can overwrite sensitive configuration parameters such as SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. The disclosure or modification of SMTP and OAuth secrets enables further attacks including account takeover via credential stuffing if email verification is compromised, or phishing campaigns using trusted sender identities. Altering storage paths may lead to unauthorized file access or denial of service by pointing the application to non-existent or malicious directories. Furthermore, modifying security feature flags can disable protective mechanisms like CSRF tokens or rate limiting, while changing autoreload settings could force unintended service restarts leading to availability issues.
Beyond direct configuration tampering, this vulnerability serves as a pivot point for more advanced attacks. By manipulating server configurations, an attacker may supply the necessary parameters to facilitate related code-injection attacks or remote command execution if certain features are misconfigured. The ability to change security flags effectively blinds the application to standard intrusion detection and prevention measures, allowing malicious activities to proceed undetected. This aligns with CWE-284 Improper Access Control and CWE-306 Missing Authentication for Critical Function, as well as MITRE ATT&CK techniques such as T1078 Valid Accounts and T1556 Credential Access or Modification of Configuration Data.
To mitigate this vulnerability, organizations running MyBooks must immediately upgrade to version 3.42.0 where the issue has been resolved. The fix ensures that the AdminSettings.post handler correctly validates administrative privileges by checking the self.admin_user property in addition to general authentication. Additionally, developers should review the process_auth_header function to ensure it strictly enforces account status checks, preventing unactivated or disabled accounts from establishing valid sessions. For deployments where immediate upgrading is not feasible, implementing a reverse proxy with strict access control lists that restricts write operations on admin endpoints exclusively to known administrator IP addresses can provide an interim layer of defense until the patch is applied.