{"id":"CVE-2026-105040","revision":"b1d5c3103b654329a134830f1f0dd8c7","records":[{"revision":"b1d5c3103b654329a134830f1f0dd8c7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-105040","aliases":[],"title":"EnergizeLab Eilik User-ID Mass Assignment Account Takeover","description":"The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.","state":0,"publishedAt":"2026-10-15T20:43:47.669+00:00","modifiedAt":"2026-10-16T19:56:03.407+00:00","affected":[{"ecosystem":"Vendor product","name":"NestJS auth service","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"EnergizeLab\",\n                    \"product\": \"NestJS auth service\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.8.2\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/xn0tsa/your-secrets-are-safe-with-me","https://takeonme.org/gcves/GCVE-1337-2026-00000000000000011111111111111111111000000000000000000011111101001111111110000000000000000000011111111111111111111000000000000010100/","https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105040","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-105040","identifiers":["CVE-2026-105040"]},"retained":false,"historicalAffected":[]}],"coverage":[]}