CVE-2026-86041

The open source personal finance application ezBookkeeping is vulnerable to an IP allowlist bypass in versions 0.10.0 through 1.6.0 . The root cause is that the Gin router is initialized without SetTrustedProxies, allowing c.ClientIP() to trust spoofed X-Forwarded-For headers. An unauthenticated ...