CVE-2026-45274Medium· 6.9▾ TwilightPoC availableMyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handlers/user.py does not enforce the ALLOW_REGISTER configuration flag, even though …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.7%
MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handlers/user.py does not enforce the ALLOW_REGISTER configuration flag, even though the frontend hides registration controls when the flag is false. An unauthenticated remote attacker can call the endpoint directly and create a valid account on an instance whose administrator disabled public registration. The process_auth_header function in webserver/handlers/base.py also does not verify the account's active flag, so the newly created and unactivated account can authenticate immediately and access user-level API functionality. The bypass defeats the intended account-creation policy and can supply the low-privilege account required by related authorization vulnerabilities. This issue is fixed in version 3.42.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45272Critical· 9.4MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook
CVE-2026-56256High· 7.1Capgo - Two-Factor Authentication Bypass via Organization Management API
CVE-2026-100306Medium· 5.3TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end
CVE-2026-77320Medium· 5.3TREK is a collaborative travel planner
CVE-2026-117554Medium· 4.3Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
CVE-2026-116605Medium· 5.3SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security