CVE-2026-105131 mayswind CVE debrief

Who should care

Defenders responsible for ezBookkeeping systems, API token management, and session token security should assess potential exposure and impact. This includes reviewing and updating API token usage and refresh policies, as well as implementing compensating controls to limit potential impact. Additionally, defenders should verify if the ezBookkeeping system is using a vulnerable version (1.2.0 before 2.0.1) and assess if attackers could exploit the

Why it matters

CVE-2026-105131 is a privilege escalation vulnerability in ezBookkeeping 1.2.0 before 2.0.1 that allows attackers to obtain full session tokens. Defenders should prioritize verifying exposure, assessing potential impact, and updating API token usage and refresh policies.

• Attackers could potentially escalate privileges and obtain full session tokens.
• API token security and refresh policies may need to be reviewed and updated.
• Defenders should verify exposure and assess potential impact on ezBookkeeping systems.

Technical summary

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API tokens for 30-day normal session tokens that bypass API token expiry and allowlists. This vulnerability enables attackers to potentially escalate privileges and gain unauthorized access to sensitive information. Defenders should prioritize verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact.

Recommended defensive actions

• Verify if the ezBookkeeping system is using a vulnerable version (1.2.0 before 2.0.1).
• Assess if attackers could exploit the vulnerability to obtain a full session token.
• Review and update API token usage and refresh policies.
• Consider implementing compensating controls to limit potential impact.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and potential impact. However, the exact scope of affected systems and the number of potentially exposed users are not specified. Defenders should verify if the ezBookkeeping system is using a vulnerable version (1.2.0 before 2.0.1) and assess if attackers could exploit the vulnerability to obtain a full session token.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.