{"id":"CVE-2026-124590","kind":"vulnerability","aliases":["CVE-2026-124590"],"related":[],"title":"library_manager_system: admin endpoints, including addBook, have no authorization checks","description":"A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The library_manager_system hobby Java app checks no authorization on its admin endpoints. Per the public issue #15, unauthenticated requests can add and delete books, categories and users; several endpoints accept GET. The issue has no maintainer reply and no fix exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"library_manager_system","fixed":[],"affected":"master at 56514767a5207caf5e04c2cea379dfaa8cb5f00b (rolling release, no versions)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","library-manager-system","no-fix","other","spring"],"not_affected_if":["not-deployed","not-internet-reachable"],"how_to_check":"Only if you run this project (commit 56514767a5207caf5e04c2cea379dfaa8cb5f00b or earlier master): without a session cookie, request /addBook, /addUser or /deleteUser. If they return true and change data, you are exposed. Also check for a Spring Security dependency or a HandlerInterceptor in the code; the issue says there is none.","fix":"No fix: the project is a rolling release, issue #15 is open with no maintainer response. Mitigate by adding Spring Security or a HandlerInterceptor that requires an admin session, restricting state changes to POST, and blocking access from the internet.","status":"open","published_at":"2026-11-09T11:17:24+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","triaged_at":"2026-11-09T11:26:28+00:00","updated_at":"2026-11-09T11:28:24+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-09T11:26:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"library_manager_system: improper authorization in book controller allows remote misuse","impact":"medium","summary":"A hobby Java library management app has an improper authorization flaw in its addBook handler, reachable through user-supplied fields. The exploit is public, so a remote attacker may be able to act beyond their permissions.","audience":"developers","category":"other","nicknames":[],"who_cares":["java","library-manager-system"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Attacker performs unauthorized actions through the book controller endpoint remotely","analyst_note":"Confirm the affected endpoint and whether authentication is required; check the NVD page and the upstream GitHub repo for any response or fix.","how_to_check":"- unknown","plain_action":"","product_name":"library_manager_system","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Teams that run zhangbw409's library_manager_system from GitHub, especially any copy exposed to the internet. The sources describe a rolling release with no version information and say the project has not responded, so no fixed version is known. Teams that do not run this project can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4688,"output_tokens":469,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected endpoint and whether authentication is required; check the NVD page and the upstream GitHub repo for any response or fix.","search":"'-124590':14A,17A '-2026':13A,16A '15':49B 'accept':62B 'add':53B 'addbook':7A 'admin':4A,43B 'affect':139C 'app':37B 'argument':99C 'attack':106C 'author':10A,40B,104C 'avail':145C 'book':56B 'bookcontroller.addbook':90C 'categori':57B 'check':11A,38B 'continu':130C 'cve':12A,15A 'delet':55B 'deliv':129C 'detect':79C 'disclos':115C 'earli':153C 'endpoint':5A,44B,61B 'exist':73B 'exploit':112C 'f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b':85C 'file':93C 'fix':28B,72B 'function':89C 'get':63B 'hobbi':35B 'impact':87C 'improp':103C 'includ':6A 'inform':137C,149C 'initi':109C 'issu':48B,65B,156C 'java':21B,36B 'lead':101C 'librari':1A,23B,32B,82C 'library':18A 'library-manager-system':22B 'maintain':68B 'manag':2A,24B,33B,83C 'manager':19A 'manipul':96C 'may':107C,118C 'model':127C 'no-fix':26B 'per':45B 'problem':152C 'product':122C 'project':147C 'public':47B,116C 'releas':126C,142C 'remot':110C 'repli':69B 'report':157C 'request':51B 'respond':161C 'result':134C 'roll':125C 'secur':75C 'sever':60B 'specif':135C 'spring':30B 'src/main/java/com/zbw/controller/usercontroller.java':94C 'system':3A,20A,25B,34B,84C 'unauthent':50B 'updat':131C,141C 'use':120C,123C 'user':59B 'username/userpwd/useremail/userid':100C 'version':136C 'vulner':76C 'yet':162C 'zhangbw409':81C","nicknames":[],"mitigations":[],"who_affected":"Anyone running zhangbw409's library_manager_system, especially a copy reachable from the internet. The public issue reports that unauthenticated clients can create and delete users, books and categories, and any logged-in user can call admin APIs. Teams that do not deploy this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["librarymanagersystem"],"ptokens":["library","manager","system"],"labels":["high","java","librarymanagersystem","nofix","other","spring","vendor"],"campaign_type":null,"search_a":"'-124590':14A,17A '-2026':13A,16A 'addbook':7A 'admin':4A 'author':10A 'check':11A 'cve':12A,15A 'endpoint':5A 'includ':6A 'librari':1A 'library':18A 'manag':2A 'manager':19A 'system':3A,20A","search_b":"'15':49B 'accept':62B 'add':53B 'admin':43B 'app':37B 'author':40B 'book':56B 'categori':57B 'check':38B 'delet':55B 'endpoint':44B,61B 'exist':73B 'fix':28B,72B 'get':63B 'hobbi':35B 'issu':48B,65B 'java':21B,36B 'librari':23B,32B 'library-manager-system':22B 'maintain':68B 'manag':24B,33B 'no-fix':26B 'per':45B 'public':47B 'repli':69B 'request':51B 'sever':60B 'spring':30B 'system':25B,34B 'unauthent':50B 'user':59B","search_c":"'affect':139C 'argument':99C 'attack':106C 'author':104C 'avail':145C 'bookcontroller.addbook':90C 'continu':130C 'deliv':129C 'detect':79C 'disclos':115C 'earli':153C 'exploit':112C 'f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b':85C 'file':93C 'function':89C 'impact':87C 'improp':103C 'inform':137C,149C 'initi':109C 'issu':156C 'lead':101C 'librari':82C 'manag':83C 'manipul':96C 'may':107C,118C 'model':127C 'problem':152C 'product':122C 'project':147C 'public':116C 'releas':126C,142C 'remot':110C 'report':157C 'respond':161C 'result':134C 'roll':125C 'secur':75C 'specif':135C 'src/main/java/com/zbw/controller/usercontroller.java':94C 'system':84C 'updat':131C,141C 'use':120C,123C 'username/userpwd/useremail/userid':100C 'version':136C 'vulner':76C 'yet':162C 'zhangbw409':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-124590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124590","severity":null,"published_at":"2026-11-09T11:17:24+00:00","modified_at":"2026-11-09T11:17:24+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","fetched_at":"2026-11-09T11:26:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124590:2273","url":"https://github.com/zhangbw409/library_manager_system/issues/15","severity":null,"published_at":"2026-11-09T11:28:24+00:00","modified_at":"2026-11-09T11:28:24+00:00","first_seen_at":"2026-11-09T11:28:24+00:00","fetched_at":"2026-11-09T11:28:24+00:00","note":"NVD page unreadable via tools (web-cli out of Exa credits; WebFetch returned only the home page). Read GitHub issue #15, which reports the same commit and unauthenticated admin endpoints incl. /addBook; open, no reply. No vendor fix. Issue is a third-party report, so nothing was marked verified. Issue rates CVSS 9.4; NVD says 7.5, severity unchanged. Public PoC steps are in the issue, but exploitation in the wild is unknown.","cites":["https://github.com/zhangbw409/library_manager_system/issues/15","https://nvd.nist.gov/vuln/detail/CVE-2026-124590"]}],"documents":[{"id":107199,"url":"https://github.com/zhangbw409/library_manager_system/issues/15","title":"Issue #15: Missing authorization on all administrative endpoints","kind":"issue","source":"analyst","publisher":null,"text":"Open since Oct 17 2026 by ThanatosXingYu, no replies. Affected commit 56514767a5207caf5e04c2cea379dfaa8cb5f00b. No Spring Security/filter/interceptor; login only sets a session attribute and no controller checks it. Unauthenticated calls to /addBook, /addBookCategory, /deleteCategory, /addUser, /deleteUser (and others in AdminController, BorrowingController) succeed; several accept GET. PoC steps in issue. Suggested fix: Spring Security or HandlerInterceptor requiring admin session, POST only, 401/403.","published_at":null,"relation":"poc","confidence":null,"note":null},{"id":107200,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124590","title":"NVD CVE-2026-124590","kind":"advisory","source":"analyst","publisher":null,"text":"NVD/VulDB description: BookController.addBook in src/main/java/com/zbw/controller/UserController.java, commits f6c9d9c9... / 56514767..., improper authorization, remote, exploit disclosed, rolling release, project informed via issue, no response.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://github.com/zhangbw409/library_manager_system/issues/15"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}