CVE-2026-105040

HighCVSS 8.8

Published: 15/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

Risk Assessment

Any registered user can take over any other account, leading to unauthorized access to the victim's data and functionality.

Recommendation

Update the auth service to a non-vulnerable version and enforce server-side authorization checks on the account identifier being modified.

Other vulnerabilities in EnergizeLab Eilik NestJS auth service

CVE-2026-105034High
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS