rootpwn

medium · CVSS v3 5.4 · CVSS v4 5.3 · EPSS 0.00198

CVE-2026-105131

ezBookkeeping 1.2.0 through 2.0.0 has a privilege escalation flaw that lets an attacker with an API token obtain a full session token. The f

Overview

ezBookkeeping 1.2.0 through 2.0.0 has a privilege escalation flaw that lets an attacker with an API token obtain a full session token. The flaw occurs because the token refresh endpoint does not validate the token type. This can allow attackers to bypass token expiry and allowlists, gaining elevated access.

Description

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API tokens for 30-day normal session tokens that bypass API token expiry and allowlists.

Impact

Confidentiality: attackers can gain full session tokens, accessing sensitive financial data. Integrity: elevated privileges can modify records. Availability: not directly impacted. Defenders: system administrators and security teams must ensure tokens are properly validated.

Remediation

Apply the official patch to ezBookkeeping 2.0.1 or later. If patch unavailable, restrict API token usage to read-only endpoints and enforce IP restrictions. Disable the /api/v1/tokens/refresh.json endpoint for API tokens or add token type validation. Rotate all API tokens and monitor for abnormal token refresh activity.

Risk context

The vulnerability has a medium severity score (CVSS 5.4) and a very low EPSS of 0.00198, indicating it is unlikely to be widely exploited. Organizations using the affected versions should still apply the fix promptly to prevent potential privilege escalation.

Affected products

  • ezBookkeeping 1.2.0
  • ezBookkeeping 2.0.0

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
5.4
CVSS v4
5.3
EPSS
0.00198

privilege escalation token abuse API session hijacking ezBookkeeping medium severity EPSS low

← All CVEs

Related CVEs

medium

CVE-2026-105144

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-105205

SiYuan versions prior to 3.8.5 allow publish‑mode readers to retrieve backlink block IDs and reference counts from password‑protected or publish‑disabled documents via API calls. This exposes hidden metadata that should remain confidential. The flaw is exploitable by sending POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID.

View analysis

medium

CVE-2026-97927

The CVE-2026-97927 flaw in the Linux kernel’s UFS filesystem causes an oops during mount teardown when cylinder group reading fails, potentially crashing the kernel. It occurs only when a writable UFS image has a corrupted first cylinder group. The issue is mitigated by applying the kernel patch that reorders root dentry creation.

View analysis

medium

CVE-2026-105096

CVE-2026-105096 is an authorization bypass vulnerability in the Customer Profile API of Omega Solution CoinEx Crypto 2025. By manipulating the ID parameter in the /customer/ endpoint, an attacker can gain unauthorized access to customer data. The flaw is exploitable remotely and has been publicly disclosed.

View analysis