CVE-2026-105131

Name of the Vulnerable Software and Affected Versions ezBookkeeping versions 1.2.0 through 2.0.0

Description A privilege escalation issue exists where attackers possessing an API token can obtain a full session token. This occurs because the TokenRefreshHandler function fails to verify the token type, allowing short-lived or IP-restricted API tokens to be exchanged for 30-day normal session tokens. This process bypasses API token expiry and allowlists via the '/api/v1/tokens/refresh.json' endpoint.

Recommendations Update ezBookkeeping to version 2.0.1.