GHSA-WCHH-MRV2-5H4Q ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist mcpallowedremoteips / apitokenallowedremoteips by sending a single X-Forwarded-For: header. The router is created with gin.New and never calls SetTrustedProxies, so gin trusts every proxy by default...

ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist mcpallowedremoteips / apitokenallowedremoteips by sending a single X-Forwarded-For: header. The router is created with gin.New and never calls SetTrustedProxies, so gin trusts every proxy by default...

Mayswind EzBookkeeping trust management issue vulnerability

Versions of mayswind ezBookkeeping from 0.10.0 up to and including 1.6.0 contain a trust management vulnerability. This arises because when constructing Gin routes using gin.New, SetTrustedProxies is not configured, allowing c.ClientIP to trust forged X-Forwarded-For values. Unauthenticated remot...