High severity8.8NVD Advisory· Published Oct 15, 2026

CVE-2026-105040

Description

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

Affected products

EnergizeLab/Eilik NestJS auth servicellm-create

Patches

Vulnerability mechanics

References

takeonme.org/gcves/GCVE-1337-2026-00000000000000011111111111111111111000000000000000000011111101001111111110000000000000000000011111111111111111111000000000000010100/nvd
www.theverge.com/tech/1010727/eiliko-robot-hack-energize-labnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000