CVE-2026-105040

The EnergizeLab Eilik NestJS auth service is vulnerable to a mass assignment flaw. The service accepts a user-controlled user ID during account update requests, allowing a registered user to modify another account's identifier. This vulnerability results in an account takeover , as an attacker ca...

CVE-2026-105038

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services are vulnerable to an authentication bypass (CWE-306) that allows unauthenticated remote attackers to access AI model administration functions . This vulnerability enables an attacker to modify AI model configurations and...

CVE-2026-105034

The EnergizeLab Eilik NestJS auth service is vulnerable to unauthenticated device-token issuance. Due to missing and improper authentication (CWE-306, CWE-287), a remote attacker can obtain a valid device token for any arbitrary robot serial number. This allows the attacker to impersonate any dev...

CVE-2026-105032

The EnergizeLab Eilik and EilikO robots are vulnerable to an unauthenticated path traversal flaw within the FastAPI AI inference and profiling services . The AI skill upload endpoint fails to require authentication and does not constrain uploaded file paths, allowing a remote attacker to write ar...