ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist mcpallowedremoteips / apitokenallowedremoteips by sending a single X-Forwarded-For: header. The router is created with gin.New and never calls SetTrustedProxies, so gin trusts every proxy by default...

GHSA-WCHH-MRV2-5H4Q ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist mcpallowedremoteips / apitokenallowedremoteips by sending a single X-Forwarded-For: header. The router is created with gin.New and never calls SetTrustedProxies, so gin trusts every proxy by default...

EUVD-2026-117162

ezBookkeeping: Source-IP allowlist MCP & API token is bypassable via a spoofed X-Forwarded-For header...

CVE-2026-86041

A flaw was found in ezBookkeeping. Due to missing trusted proxy configurations in the web router, the application inherently trusts client-supplied network headers. A remote attacker can exploit this flaw by sending a request with a spoofed X-Forwarded-For HTTP header containing an authorized IP...

CVE-2026-86041

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

CVE-2026-86041

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

CVE-2026-86041 ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

CVE-2026-86041 ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

CVE-2026-86041

The open source personal finance application ezBookkeeping is vulnerable to an IP allowlist bypass in versions 0.10.0 through 1.6.0 . The root cause is that the Gin router is initialized without SetTrustedProxies, allowing c.ClientIP() to trust spoofed X-Forwarded-For headers. An unauthenticated ...

CVE-2026-86041 ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

PT-2026-137224

Name of the Vulnerable Software and Affected Versions ezBookkeeping versions 0.10.0 through 1.5.9 Description The application constructs its Gin router using gin.New without configuring SetTrustedProxies, which leads c.ClientIP to trust spoofed X-Forwarded-For values. An unauthenticated remote...

CVE-2026-86041: mayswind ezbookkeeping: ezBookkeeping is an open source, self-hosted personal finance application

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

Mayswind EzBookkeeping trust management issue vulnerability

Versions of mayswind ezBookkeeping from 0.10.0 up to and including 1.6.0 contain a trust management vulnerability. This arises because when constructing Gin routes using gin.New, SetTrustedProxies is not configured, allowing c.ClientIP to trust forged X-Forwarded-For values. Unauthenticated remot...

CVE-2026-105131

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-105131

The mayswind ezBookkeeping software (versions 1.2.0 before 2.0.1) is vulnerable to a privilege escalation flaw in the /api/v1/tokens/refresh.json endpoint. The root cause is that the TokenRefreshHandler fails to verify the token type, allowing an attacker with an API token to exchange it for a 30...

CVE-2026-105131 mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

EUVD-2026-92060

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-105131

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-105131 mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-105131 mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...