MyBooks (Talebook) web server allows an attacker to create an account even when the ALLOW_REGISTER configuration flag is false. The SignUp.post handler for POST /api/user/sign_up does not enforce this flag, and because process_auth_header does not check the account’s active status, the newly created user can authenticate right away and access user‑level API functionality. This enables an unauthenticated remote attacker to obtain a valid user account with full API privileges, effectively bypassing the intended registration policy and providing an entry point for further exploitation.

The vulnerability exists in PoxenStudio Talebook versions 3.41.2 and earlier. Version 3.42.0 contains the fix that enforces ALLOW_REGISTER and requires account activation before authentication. No other version information is supplied.

The CVSS score of 6.9 indicates a moderate severity. EPSS information is not available, so the exploitation probability cannot be quantified but the vulnerability is trivially exploitable by directly POSTing to /api/user/sign_up from any network accessible to the server. The vulnerability is not listed in the CISA KEV catalog, yet it can still provide a foothold for further privilege escalation or exploitation of related authorization weaknesses. Attackers with networking access can bypass registration controls and gain immediate user-level API access.