In PoxenStudio Talebook (MyBooks) versions 3.41.2 and earlier, the SignUp.post handler for the POST /api/user/sign_up endpoint fails to enforce the ALLOW_REGISTER configuration flag server-side, despite the frontend hiding registration controls when this flag is false. An unauthenticated remote attacker can exploit this by directly calling the endpoint to create valid accounts on instances where public registration is disabled. Furthermore, the process_auth_header function does not verify the account's active status, allowing immediate authentication and access to user-level API functions with the newly created account. This vulnerability circumvents the intended account creation restrictions and can enable exploitation of related authorization vulnerabilities. The issue is resolved in version 3.42.0.

An unauthenticated attacker can create valid user accounts on systems where public registration is disabled, bypassing administrative controls. These accounts can authenticate immediately without activation, granting access to user-level API functionality. This undermines the intended security policy for account creation and may facilitate further exploitation of authorization weaknesses.

Upgrade to PoxenStudio Talebook version 3.42.0 or later, where this vulnerability is fixed. There is no official patch or temporary fix available other than upgrading. Until then, administrators should be aware that disabling public registration via the ALLOW_REGISTER flag is ineffective in affected versions.