CVE-2026-86041
Description
A flaw was found in ezBookkeeping. Due to missing trusted proxy configurations in the web router, the application inherently trusts client-supplied network headers. A remote attacker can exploit this flaw by sending a request with a spoofed X-Forwarded-For HTTP header containing an authorized IP address. This enables the attacker to bypass IP-based access restrictions and cause subsequent actions to be falsely attributed to trusted hosts in audit and transaction logs.
Statement
This vulnerability is rated with Moderate impact because, while the issue is remotely exploitable, forging source IP addresses alone does not grant access to restricted functionality without possessing legitimate authentication tokens. The blast radius is limited to bypassing IP filtering rules and spoofing audit attribution rather than full privilege escalation or arbitrary execution. Furthermore, ezBookkeeping is not distributed or supported within Red Hat enterprise products.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
An attacker could utilize the untrusted data source to bypass protection mechanisms and gain access to sensitive data.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
