CVE-2026-105040
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).
Published Oct 15, 2026 · updated Oct 15, 2026
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
Sources
- CVE.orgVulnerability recordCVE-2026-105040
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-105040
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
nvd.nist.gov