CVE-2026-45273: MyBooks Auth Bypass Vulnerability

CVE-2026-45273 Overview

CVE-2026-45273 is a missing authorization vulnerability [CWE-862] in MyBooks (also known as Talebook), an ebook management web server. The flaw affects versions 3.41.2 and earlier. The AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the @auth decorator but omits an self.admin_user check that the corresponding GET handler enforces. Any authenticated regular user can overwrite server configuration values, including SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. A secondary flaw in process_auth_header allows unactivated accounts to authenticate. The issue is fixed in version 3.42.0.

Critical Impact
Any authenticated low-privilege user, including registered-but-unactivated accounts, can overwrite server settings, disclose secrets, sabotage the application, and stage follow-on code-injection attacks.

Affected Products

MyBooks (Talebook) versions 3.41.2 and earlier
webserver/handlers/admin.py — AdminSettings.post handler
webserver/handlers/base.py — process_auth_header function

Discovery Timeline

2026-08-19 - CVE-2026-45273 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-45273

Vulnerability Analysis

MyBooks exposes an administrative settings endpoint at POST /api/admin/settings served by the AdminSettings.post handler. The handler is decorated with @auth, which only confirms that a request carries a valid session. Unlike the paired GET handler, the POST handler never checks self.admin_user, so authorization is missing after authentication succeeds. A regular authenticated user can therefore submit a JSON body that overwrites arbitrary server configuration keys.

The writable keys include SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. Attackers can exfiltrate secrets through subsequent configuration reads, disable security controls, redirect storage, or trigger service restarts. Modified settings can also supply the preconditions for related code-injection attacks tracked in the same advisory.

A second defect in process_auth_header (webserver/handlers/base.py) validates the password but does not verify the account's active flag. Registered accounts pending activation can therefore authenticate and reach the vulnerable POST handler, expanding the pool of usable attacker identities.

Root Cause

The root cause is a missing authorization check [CWE-862] in a state-changing administrative handler. Authentication was conflated with authorization: the @auth decorator gates identity but not privilege. The activation-flag omission compounds the impact by weakening the identity check itself.

Attack Vector

Exploitation is remote and network-based. An attacker registers or uses any low-privilege account, authenticates against the web server, and issues a crafted POST /api/admin/settings request with a JSON payload containing the target configuration keys. No administrator interaction is required.

python

# Patch: webserver/handlers/admin.py
     @js
     @auth
     def post(self):
+        if not self.admin_user:
+            return {"err": "permission.not_admin", "msg": _("当前用户非管理员")}
+
         data = tornado.escape.json_decode(self.request.body)
         KEYS = [
             "ALLOW_GUEST_DOWNLOAD",

Source: GitHub Commit a1780c9

python

# Patch: webserver/handlers/base.py
             return False
         if user.get_secure_password(password) != str(user.password):
             return False
+        if not user.active:
+            return False
         self.mark_invited()
         self.login_user(user)
         return True

Source: GitHub Commit a1780c9

Detection Methods for CVE-2026-45273

Indicators of Compromise

Unexpected POST /api/admin/settings requests originating from non-administrator session identifiers.
Configuration changes to SMTP credentials, OAuth client secrets, storage paths, or autoreload flags that do not correlate with an admin change window.
Successful authentications from accounts whose active flag is false in the user store.
Service restarts or autoreload events immediately following a settings POST from a low-privilege user.

Detection Strategies

Compare the session's user role against the target endpoint by logging both the authenticated user ID and the admin_user boolean on every /api/admin/* request.
Alert on any 2xx response to POST /api/admin/settings where the request user is not in the administrator group.
Diff configuration state on a schedule and raise events on drift in sensitive keys such as SMTP, OAuth, and storage paths.

Monitoring Recommendations

Ingest MyBooks application logs and web-tier access logs into a centralized log platform and retain them for post-incident review.
Track authentication events for accounts flagged as inactive or pending activation.
Monitor for outbound connections to attacker-controlled SMTP or OAuth endpoints that could indicate settings tampering.

How to Mitigate CVE-2026-45273

Immediate Actions Required

Upgrade MyBooks (Talebook) to version 3.42.0 or later, which adds the self.admin_user check and the user.active verification.
Rotate any secrets stored in server configuration, including SMTP credentials and OAuth client secrets, on the assumption they may have been read or overwritten.
Review the user database for accounts with active = false that have login history and disable or purge unused registrations.
Audit recent modifications to configuration keys and revert unauthorized changes.

Patch Information

The fix is delivered in MyBooks release 3.42.0. The remediating commit adds an admin_user guard to AdminSettings.post and an active flag check to process_auth_header. Full details are available in GHSA-354j-9hx8-3p45.

Workarounds

Restrict access to /api/admin/* at a reverse proxy by IP allowlist until the patch is applied.
Disable open user registration to prevent attackers from creating the low-privilege accounts required for exploitation.
Require administrator approval and activation before new accounts can authenticate, reducing the impact of the missing active flag check.

bash

# Example nginx restriction for /api/admin/ endpoints
location /api/admin/ {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://mybooks_upstream;
}