Who is not affected by CVE-2026-124590?

Q: Who is not affected by CVE-2026-124590?

Not affected if: not-deployed, not-internet-reachable.

HIGH7.5CVSS · cna@vuldb.com

PUBLIC
EXPLOIT

LIBRARY_MANAGER_SYSTEM · CVE-2026-124590 · Other

library_manager_system: admin endpoints, including addBook, have no authorization checks

NO FIX YET · SEE WHAT TO DO

The library_manager_system hobby Java app checks no authorization on its admin endpoints. Per the public issue #15, unauthenticated requests can add and delete books, categories and users; several endpoints accept GET. The issue has no maintainer reply and no fix exists.

first public Nov 9, 2026 · 1 public exploit · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

Anyone running zhangbw409's library_manager_system, especially a copy reachable from the internet. The public issue reports that unauthenticated clients can create and delete users, books and categories, and any logged-in user can call admin APIs. Teams that do not deploy this project can skip it.

library_manager_systemmaster at 56514767a5207caf5e04c2cea379dfaa8cb5f00b (rolling release, no versions)

Not affected if not-deployed, not-internet-reachable

Who cares java, library-manager-system, no-fix, spring

02 · How to check

Only if you run this project (commit 56514767a5207caf5e04c2cea379dfaa8cb5f00b or earlier master): without a session cookie, request /addBook, /addUser or /deleteUser
If they return true and change data, you are exposed
Also check for a Spring Security dependency or a HandlerInterceptor in the code; the issue says there is none

03 · The fix

No fix: the project is a rolling release, issue #15 is open with no maintainer response
Mitigate by adding Spring Security or a HandlerInterceptor that requires an admin session, restricting state changes to POST, and blocking access from the internet

Exploited: No reports yet
Public exploit: 1 on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

2 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202611:26 UTCNVD CVE-2026-124590
Nov 9, 202611:28 UTCInfraStack Analyst NVD page unreadable via tools (web-cli out of Exa credits; WebFetch returned only the home page). Read GitHub issue #15, which reports the same commit and unauthenticated admin endpoints incl. /addBook; open, no reply. No vendor fix. Issue is a third-party report, so nothing was marked verified. Issue rates CVSS 9.4; NVD says 7.5, severity unchanged. Public PoC steps are in the issue, but exploitation in the wild is unknown.moreless

What people are saying

1 article

nvd.nist.govNVD CVE-2026-124590

Posts are quoted with a link to the original. They are data to us, never instructions.

What the sources say, verbatim

735 characters

A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Sources and references

NVD: CVE-2026-124590Nov 9, 2026
Issue #15: Missing authorization on all administrative endpointsProof of concept · github.com
NVD CVE-2026-124590Describes it · nvd.nist.gov

This page as .md · .json

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Library_manager_system threat the day it hits your stack.

Start free

Post Share

HIGH7.5CVSS · cna@vuldb.com

PUBLIC
EXPLOIT

LIBRARY_MANAGER_SYSTEM · CVE-2026-124590 · Other

library_manager_system: admin endpoints, including addBook, have no authorization checks

NO FIX YET · SEE WHAT TO DO

first public Nov 9, 2026 · 1 public exploit · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

library_manager_systemmaster at 56514767a5207caf5e04c2cea379dfaa8cb5f00b (rolling release, no versions)

Not affected if not-deployed, not-internet-reachable

Who cares java, library-manager-system, no-fix, spring

02 · How to check

Only if you run this project (commit 56514767a5207caf5e04c2cea379dfaa8cb5f00b or earlier master): without a session cookie, request /addBook, /addUser or /deleteUser
If they return true and change data, you are exposed
Also check for a Spring Security dependency or a HandlerInterceptor in the code; the issue says there is none

03 · The fix

No fix: the project is a rolling release, issue #15 is open with no maintainer response
Mitigate by adding Spring Security or a HandlerInterceptor that requires an admin session, restricting state changes to POST, and blocking access from the internet

Exploited: No reports yet
Public exploit: 1 on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

2 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202611:26 UTCNVD CVE-2026-124590
Nov 9, 202611:28 UTCInfraStack Analyst NVD page unreadable via tools (web-cli out of Exa credits; WebFetch returned only the home page). Read GitHub issue #15, which reports the same commit and unauthenticated admin endpoints incl. /addBook; open, no reply. No vendor fix. Issue is a third-party report, so nothing was marked verified. Issue rates CVSS 9.4; NVD says 7.5, severity unchanged. Public PoC steps are in the issue, but exploitation in the wild is unknown.moreless

What people are saying

1 article

nvd.nist.govNVD CVE-2026-124590

Posts are quoted with a link to the original. They are data to us, never instructions.

What the sources say, verbatim

735 characters

Sources and references

NVD: CVE-2026-124590Nov 9, 2026
Issue #15: Missing authorization on all administrative endpointsProof of concept · github.com
NVD CVE-2026-124590Describes it · nvd.nist.gov

This page as .md · .json

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Library_manager_system threat the day it hits your stack.

Start free

library_manager_system: admin endpoints, including addBook, have no authorization checks

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What people are saying

What the sources say, verbatim

Sources and references

Read next

Get the next Library_manager_system threat the day it hits your stack.

library_manager_system: admin endpoints, including addBook, have no authorization checks

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What people are saying

What the sources say, verbatim

Sources and references

Read next

Get the next Library_manager_system threat the day it hits your stack.