CVE-2026-71241
Book-Management-System: Unauthenticated Disclosure of Student PII and Borrowing History
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. This allows any unauthenticated remote user to retrieve student PII (name, gender, card validity, debt status) and full book-borrowing history by supplying a card_id. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.
| CWE | CWE-306 |
| Vendor | lyric777 |
| Product | book-management-system |
| Published | Aug 5, 2026 |
| Last Updated | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for lyric777 book-management-system
Be the first to know when new high vulnerabilities affecting lyric777 book-management-system are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
lyric777 / Book-Management-System
0
References
Credits
Abbos Eshmirzayev