In Talebook (MyBooks) version 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings applies an authentication decorator but fails to verify the self.admin_user property, unlike the GET handler. This allows any authenticated regular user to overwrite sensitive server configuration settings including SMTP credentials, OAuth client secrets, storage paths, security flags, and autoreload settings. Additionally, the process_auth_header function does not check if the account is active, allowing unactivated accounts to authenticate and exploit this vulnerability. Exploitation can disclose secrets, sabotage application behavior, force service restarts, and facilitate code-injection attacks. The vulnerability is addressed in version 3.42.0.

Any authenticated user, including those with unactivated accounts, can modify critical server configuration parameters, leading to potential secret disclosure, disruption of application functionality, forced restarts, and enabling further attacks such as code injection. This compromises the confidentiality, integrity, and availability of the affected system.

Upgrade Talebook to version 3.42.0 or later, where this authorization issue is fixed. Until upgrading, restrict access to authenticated users with verified admin privileges and monitor for unauthorized configuration changes. Patch status is confirmed fixed in 3.42.0.