---
id: CVE-2026-86041
title: >-
  ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a
  spoofed `X-Forwarded-For` header
summary: >-
  ezBookkeeping is an open source, self-hosted personal finance application.
  From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with
  gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust
  a spoofed X-F…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-348
vendor: mayswind
product: ezbookkeeping
affected:
  - 'ezbookkeeping >= 0.10.0, < 1.6.0'
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:47:23.543425Z'
exploitAvailable: true
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:48:52.330Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86041'
references:
  - url: >-
      https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q
    label: >-
      https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q
  - url: >-
      https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986
    label: >-
      https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986
  - url: 'https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0'
    label: 'https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0'
tags:
  - cve.org
  - exploit-available
epss: 0.00221
epssPercentile: 0.12756
ingestedAt: '2026-11-05T22:38:31.558Z'
---

## Overview

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0.

## Affected

- `ezbookkeeping >= 0.10.0, < 1.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.