CVE-2026-86041

Name of the Vulnerable Software and Affected Versions ezBookkeeping versions 0.10.0 through 1.5.9

Description The application constructs its Gin router using gin.New() without configuring SetTrustedProxies, which leads c.ClientIP() to trust spoofed X-Forwarded-For values. An unauthenticated remote attacker can provide an allowlisted address to bypass the mcp allowed remote ips or api token allowed remote ips gates. While a valid MCP or API token is still required for protected actions, the spoofed value is recorded in Transaction.CreatedIp and the request log, incorrectly attributing the activity to a trusted host.

Recommendations Update to version 1.6.0.