CVE-2026-45274: MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement
MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/signup in webserver/handlers/user.py does not enforce the ALLOWREGISTER configuration flag, even though the frontend hides registration controls when the flag is false. An unauthenticated remote attacker can call the endpoint directly and create a valid account on an instance whose administrator disabled public registration. The processauthheader function in webserver/handlers/base.py also does not verify the account's active flag, so the newly created and unactivated account can authenticate immediately and access user-level API functionality. The bypass defeats the intended account-creation policy and can supply the low-privilege account required by related authorization vulnerabilities. This issue is fixed in version 3.42.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBooks (Talebook)to a version that resolves this vulnerability.Fixed in 3.42.0 - Compensating control
Ensure public registration is disabled via the ALLOW_REGISTER configuration flag, since the described bypass defeats the intended server-side enforcement when it is not fixed.
Event History
Frequently Asked Questions
Which deployments are exposed to this registration bypass?
MyBooks/Talebook 3.41.2 and earlier are affected. Instances are exposed even when an administrator has disabled public registration, because the server-side sign-up endpoint does not enforce the ALLOW_REGISTER setting.
What does an attacker need to exploit the issue?
An attacker only needs unauthenticated remote access to the POST /api/user/sign_up endpoint. They can invoke the endpoint directly rather than using the hidden frontend registration controls.
What access does a successfully created account receive?
The created account can authenticate immediately even if it is unactivated, because authentication does not check the account active flag. This provides access to user-level API functionality and may provide the low-privilege account needed for related authorization issues.
What is the available remediation?
Upgrade to MyBooks/Talebook version 3.42.0, which fixes the issue.