PoxenStudio Talebook up to 3.41.2 Admin Settings admin.py AdminSettings.post privileges management

Summaryinfo

A vulnerability categorized as critical has been discovered in PoxenStudio Talebook up to 3.41.2. Affected is the function AdminSettings.post of the file webserver/handlers/admin.py of the component Admin Settings. Such manipulation leads to privileges management. This vulnerability is listed as CVE-2026-45273. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in PoxenStudio Talebook up to 3.41.2. It has been rated as critical. Affected by this issue is the function AdminSettings.post of the file webserver/handlers/admin.py of the component Admin Settings. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.admin_user property, unlike the corresponding GET handler. Any authenticated regular user can therefore overwrite server configuration values including SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. The process_auth_header function in webserver/handlers/base.py also fails to verify the matched account's active flag, allowing a registered but unactivated account to authenticate and reach the vulnerable handler. Exploitation can disclose secrets through configuration access paths, sabotage application behavior, force service restarts, and supply the settings needed for related code-injection attacks. This issue is fixed in version 3.42.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-45273 since 05/11/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 3.42.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• PoxenStudio

Name

• Talebook

Version

• 3.41.0
• 3.41.1
• 3.41.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion