Mass Assignment Vulnerability in EnergizeLab Eilik NestJS Auth Service

CVE-2026-105040

What is CVE-2026-105040?

The EnergizeLab Eilik NestJS authentication service is vulnerable to mass assignment due to improper handling of user input. Specifically, the system allows registered users to send updates containing user-controlled identifiers to modify account settings. This flaw can be exploited by malicious users to take over accounts by altering the user ID, potentially gaining unauthorized access to sensitive information and performing actions on behalf of other users. It is crucial for users and administrators to be aware of this vulnerability and take necessary precautions to safeguard user accounts.

References