Skip to content

CVE record · 1 source

CVE-2026-105040

CVSS 8.8

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).

Vendor: Node.js
Product: Node.js
CVSS: 8.8
Exposure class: Developer platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

15

CVE NVD 16d ago

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

CVSS 8.8 CVE-2026-105040 Node.js