Security Flaw in ezBookkeeping by Mayswind Allows IP Spoofing

CVE-2026-86041

What is CVE-2026-86041?

The ezBookkeeping application, designed for personal finance management, contains a security vulnerability that arises from not configuring trusted proxy settings properly. This oversight allows an unauthenticated remote attacker to exploit the application by supplying a spoofed IP address through the X-Forwarded-For header. Consequently, the system may incorrectly log the attacker's actions under a trusted host's IP, rather than identifying the true source of the request. This issue affects versions 0.10.0 to 1.5.0 and has been resolved in version 1.6.0, which introduces appropriate security measures.

References