Is CVE-2026-105040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105040 being exploited in the wild.

How severe is CVE-2026-105040?

High severity, with a CVSS score of 8.8, published 15 October 2026.

Is there a fix for CVE-2026-105040?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-105040 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105040?

Check whether you run EnergizeLab Eilik. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105040: EnergizeLab Eilik NestJS auth service mass assignment account takeover

CVE-2026-105040 · Severity: high · CVSS 8.8 · Published 2026-10-15

EnergizeLab Eilik is a robot platform that uses a NestJS authentication service to manage user accounts. An attacker can exploit a mass assignment vulnerability in the account update feature to change another user's account identifier and take over their account by making a simple request with a modified user ID parameter.

Technologies: EnergizeLab Eilik. Vendors: EnergizeLab.

Quick answers

Is CVE-2026-105040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105040 being exploited in the wild.
How severe is CVE-2026-105040?: High severity, with a CVSS score of 8.8, published 15 October 2026.
Which products and versions are affected?: EnergizeLab Eilik.
Is there a fix for CVE-2026-105040?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105040 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105040?: Check whether you run EnergizeLab Eilik. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The NestJS auth service fails to validate that a user can only modify their own account identifier during update requests, allowing a registered user to submit a user-controlled user ID parameter that overwrites another account's identifier. This mass assignment vulnerability allows account takeover without requiring elevated privileges or special authentication beyond a valid user account.

Affected products

EnergizeLab Eilik

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.