CVE-2026-105040: EnergizeLab Eilik User-ID Mass Assignment Account Takeover
Published Oct 15, 2026
·Updated
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
Affected Software
1 affected component
EnergizeLab Eilik
Event History
Oct 15, 2026
CVE Published
via MITRE·08:43 PM
Data Sourced
via MITRE·08:43 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs a registered user account. No user interaction is required.
2
What is the potential impact of successful exploitation?
A registered attacker can change an account identifier to that of another account and take over the targeted account. The reported impact includes compromise of confidentiality, integrity, and availability.