CVE-2026-105040
8.8HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-639
Impact
Authenticated attackers can completely take over other user accounts. They only need standard registered user access to send modified account update requests.
Root cause
The NestJS auth service binds user-controlled IDs from account update requests directly to internal records without validation (mass assignment / IDOR).
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Patch the auth service backend to ignore client-supplied user identifiers and rely strictly on the session or JWT context. If an update cannot be deployed immediately, block or filter account update requests passing custom user ID fields at the API gateway or reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.