CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint
Authenticated users can modify admin settings due to missing authorization checks, enabling privilege escalation and secret disclosure in MyBooks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45273?
CVE-2026-45273 is a high-severity missing authorization vulnerability in PoxenStudio talebook, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.admin_user property, unlike the corresponding GET handler. Any authenticated regular user can therefore overwrite server configuration values including SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. The process_auth_header function in webserver/handlers/base.py also fails to verify the matched account's active flag, allowing a registered but unactivated account to authenticate and reach the vulnerable handler. Exploitation can disclose secrets through configuration access paths, sabotage application behavior, force service restarts, and supply the settings needed for related code-injection attacks. This issue is fixed in version 3.42.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-45273?
How do I fix CVE-2026-45273?
No fix has been published for CVE-2026-45273 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45273 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45273 exists.
Sources
Also known as GHSA-354j-9hx8-3p45.