CVE-2026-45273: MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint
MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any authenticated regular user can therefore overwrite server configuration values including SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. The processauthheader function in webserver/handlers/base.py also fails to verify the matched account's active flag, allowing a registered but unactivated account to authenticate and reach the vulnerable handler. Exploitation can disclose secrets through configuration access paths, sabotage application behavior, force service restarts, and supply the settings needed for related code-injection attacks. This issue is fixed in version 3.42.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBooks (Talebook)to a version that resolves this vulnerability.Fixed in 3.42.0 - Compensating control
Ensure only activated/admin accounts can authenticate to the MyBooks admin settings endpoint (POST /api/admin/settings) until all instances are upgraded to 3.42.0.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated regular MyBooks user can submit changes to the admin settings endpoint. A registered account that has not been activated may also authenticate because the authentication code does not verify the account active flag.
Are default deployments affected?
Deployments running MyBooks/Talebook 3.41.2 or earlier are affected if an attacker can authenticate with a regular or unactivated registered account. The vulnerable POST endpoint requires authentication but does not require administrator authorization.
What can an attacker change through the vulnerable endpoint?
An attacker can overwrite server configuration values, including SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. These changes can enable secret disclosure through configuration access paths, disrupt service behavior, trigger restarts, or support related code-injection attacks.
What should be done if an immediate upgrade is not possible?
Restrict access to authenticated MyBooks accounts, especially regular and unactivated accounts, because either can reach the affected handler. Monitor and review changes to server configuration values and investigate unexpected restarts, altered security flags, credential changes, or storage-path changes.
How can I determine whether the issue has been remediated?
Upgrade to MyBooks/Talebook 3.42.0, which fixes the issue. On affected versions, POST requests to /api/admin/settings made by a non-admin authenticated account indicate the authorization check is missing.