CVE-2026-45274 is a vulnerability in MyBooks, an eBook management web server, also known as Talebook. The vulnerability allows an unauthenticated remote attacker to create a valid account on an instance where public registration has been disabled by the administrator. This is possible because the SignUp.post handler in webserver/handlers/user.py does not enforce the ALLOW_REGISTER configuration flag. Furt [truncated]
CVE-2026-45273 is a high-severity vulnerability in MyBooks, an ebook management web server. An authenticated regular user can overwrite server configuration values, including SMTP credentials and OAuth client secrets, due to improper authorization in the AdminSettings.post handler. This issue is fixed in version 3.42.0. The vulnerability allows for configuration access, potential disclosure of sensitive i [truncated]
CVE-2026-45272 is a critical vulnerability in MyBooks, an enhanced personal ebook management web server. The vulnerability exists in versions 3.41.2 and earlier, where the AdminSettings.post handler accepts SOCIAL_AUTH key names without proper validation, allowing an administrator to inject arbitrary Python statements. These statements can be executed with the privileges of the application service account [truncated]
