Ebook Management Web Server Vulnerability in MyBooks by PoxenStudio

CVE-2026-45274

What is CVE-2026-45274?

MyBooks, an ebook management web server by PoxenStudio, suffers from a significant flaw in the SignUp.post handler for the /api/user/sign_up endpoint. In versions 3.41.2 and earlier, this vulnerability allows an unauthenticated remote attacker to create a valid user account, despite the administrator disabling public registration through the ALLOW_REGISTER configuration. This occurs because the system fails to enforce the registration settings, as the frontend hides registration controls without actually preventing direct API access. Additionally, the process_auth_header function neglects to verify whether the new account is active, allowing immediate authentication and access to user-level API functionalities. This bypass undermines the intended account creation policies, potentially leading to further exploitation through related authorization vulnerabilities. Users are encouraged to upgrade to version 3.42.0, which addresses these issues.

References