MyBooks (Talebook) is an e‑book management web server that, in versions 3.41.2 and earlier, fails to enforce that only administrator accounts can POST to /api/admin/settings. The POST handler is protected by an authentication decorator but does not verify the admin flag, and the authentication routine incorrectly accepts unactivated accounts. Consequently, any authenticated regular user can overwrite configuration files, expose SMTP credentials, OAuth secrets, storage locations, security flags, and autoreload settings. By changing these values an attacker can recover secret keys, disrupt service behavior, force restarts, or set the stage for further code‑injection attacks.

The affected product is PoxenStudio Talebook (also known as MyBooks). Versions 3.41.2 and earlier are vulnerable; the issue is resolved in release 3.42.0.

The CVSS score is 8.7, rating the vulnerability as high severity. EPSS is not available, so the exact likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web request to the POST /api/admin/settings endpoint from an authenticated user, including accounts that are registered but not yet activated. Attackers can change configuration files to obtain secret credentials or disrupt service availability. Because the flaw resides in application logic rather than infrastructure, exploitation requires only legitimate authentication credentials, which can be obtained by legitimate use or phishing.