Read the docs
TI-2026-85247 Aliases CVE-2026-86041

Source-IP allowlist bypass via spoofed X-Forwarded-For in ezBookkeeping

Priority MEDIUM 57CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ezBookkeeping, a self-hosted personal finance application, from 0.10.0 before 1.6.0 builds its Gin router without configuring trusted proxies. As a result, c.ClientIP() trusts a spoofed X-Forwarded-For header. An unauthenticated remote attacker can supply an allowlisted address to bypass the source-IP allowlist for MCP and API tokens, though a valid token is still required. Activity is then attributed to the trusted address in Transaction.CreatedIp and the request log (CWE-348).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00221 12th percentileScored 2026-11-07
Fix Fixed ezbookkeeping (mayswind): 1.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mayswindezbookkeeping0.10.0 to before 1.6.01.6.0Patch availableCNA
  • ezbookkeeping Vendormayswind Affected 0.10.0 to before 1.6.0 Fixed in 1.6.0 Patch available CNA

Remediation

Upgrade ezBookkeeping to version 1.6.0, which fixes the issue. Red Hat lists one product as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ezbookkeeping (mayswind) Fixed in 1.6.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-86041
  2. 2026-11-05 CISA SSVC decision points changed
  3. 2026-11-05 Priority changed: LOW → MEDIUM
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 3

  • TI-2024-37958 An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component. CVSS 3.1CRITICAL 9.8
  • TI-2025-40384 mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in… CVSS 3.1MEDIUM 6.5
  • TI-2024-37957 An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting. CVSS 3.1MEDIUM 6.3
  • TI-2026-63328 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack CVSS 4.0HIGH 7.6
  • TI-2026-67507 mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences