A security vulnerability has been discovered in the ezBookkeeping software, specifically in its use of the Gin framework. The vulnerability allows an attacker to bypass the source-IP allowlist by sending a spoofed `X-Forwarded-For` header, which is trusted by Gin due to a lack of explicit proxy configuration. This allows the attacker to access the system and forge attribution by setting the client IP address to the attacker-supplied header value. The impact is that an attacker can bypass security controls and remain anonymous, making it difficult to track and audit activities.