CVE-2026-45273

Name of the Vulnerable Software and Affected Versions MyBooks versions prior to 3.42.0

Description The AdminSettings.post handler for the endpoint "/api/admin/settings" in webserver/handlers/admin.py fails to verify the self.admin user property. This allows any authenticated regular user to overwrite server configuration values, such as SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. Additionally, the process auth header() function in webserver/handlers/base.py does not verify the active flag of the matched account, enabling registered but unactivated accounts to authenticate and access the vulnerable handler. This can lead to the disclosure of secrets, sabotage of application behavior, forced service restarts, and the facilitation of code-injection attacks.

Recommendations Update to version 3.42.0.