Unauthorized Access in Book-Management-System by Lyric777

CVE-2026-71241

What is CVE-2026-71241?

The Book-Management-System is vulnerable due to its Flask API endpoints (/student, /record, /books, /find_stu_book, /find_not_return_book) lacking the necessary security measure of the @login_required decorator. This oversight permits unauthenticated remote users to access sensitive personally identifiable information (PII) of students, including names, gender, card validity, and debt status. Additionally, attackers can exploit sequential card_id values to enumerate the whole student database, compromising a large amount of confidential data without any form of authentication.

References