TI-2026-75008 Aliases CVE-2026-105040

Mass assignment in EnergizeLab Eilik enables account takeover

MEDIUM 40CWE-639Published 2026-10-15 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

EnergizeLab Eilik NestJS auth service from 1.8.2 is affected. Its account update requests accept a user-controlled user ID, a mass assignment flaw (CWE-639) that lets a registered user set another account's identifier. A remote attacker with a low-privilege registered account can take over other accounts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00348 28th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
EnergizeLab	NestJS auth service	1.8.2	—	No fix listed	CNA

NestJS auth service VendorEnergizeLab Affected 1.8.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for EnergizeLab Eilik NestJS auth service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-16 Threatist record created from CVE-2026-105040
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-18 CISA SSVC decision points changed
2026-10-18 Priority changed: LOW → MEDIUM

References

Advisory 1

https://takeonme.org/gcves/GCVE-1337-2026-00000000000000011111111111111111111000000000000000000011111101001111111110000000000000000000011111111111111111111000000000000010100/

Other 2

TI-2026-75006 EnergizeLab Eilik lacks authentication on AI model administration CVSS 3.1CRITICAL 9.8
TI-2026-75000 Unauthenticated path traversal in EnergizeLab Eilik AI skill upload CVSS 3.1CRITICAL 9.1
TI-2026-75007 EnergizeLab station middleware admin APIs lack role checks CVSS 3.1CRITICAL 9.6
TI-2026-75005 Path traversal in EnergizeLab station-middleware allows file reads CVSS 3.1CRITICAL 9.9
TI-2026-75002 EnergizeLab Eilik issues device tokens without authentication CVSS 3.1HIGH 8.2
TI-2026-75001 Default root credentials and enabled SSH in EnergizeLab AI Station CVSS 3.1HIGH 8.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences