---
id: "CVE-2026-124590"
page: "https://infrastack.ai/live/CVE-2026-124590"
kind: "vulnerability"
aliases: ["CVE-2026-124590"]
title: "library_manager_system: admin endpoints, including addBook, have no authorization checks"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "library_manager_system", "fixed": [], "affected": "master at 56514767a5207caf5e04c2cea379dfaa8cb5f00b (rolling release, no versions)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["java", "library-manager-system", "no-fix", "other", "spring"]
not_affected_if: ["not-deployed", "not-internet-reachable"]
published_at: "2026-11-09T11:17:24+00:00"
first_seen_at: "2026-11-09T11:26:04+00:00"
updated_at: "2026-11-09T11:28:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124590", "first_seen_at": "2026-11-09T11:26:04+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124590", "first_seen_at": "2026-11-09T11:28:24+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-124590", "https://github.com/zhangbw409/library_manager_system/issues/15"]}]
exploit_sources: [{"type": "poc", "url": "https://github.com/zhangbw409/library_manager_system/issues/15"}]
---

# library_manager_system: admin endpoints, including addBook, have no authorization checks

Link for people: https://infrastack.ai/live/CVE-2026-124590 (this .md is for agents)

The library_manager_system hobby Java app checks no authorization on its admin endpoints. Per the public issue #15, unauthenticated requests can add and delete books, categories and users; several endpoints accept GET. The issue has no maintainer reply and no fix exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:library_manager_system affected master at 56514767a5207caf5e04c2cea379dfaa8cb5f00b (rolling release, no versions) fixed no fixed version listed

## How to check

Only if you run this project (commit 56514767a5207caf5e04c2cea379dfaa8cb5f00b or earlier master): without a session cookie, request /addBook, /addUser or /deleteUser. If they return true and change data, you are exposed. Also check for a Spring Security dependency or a HandlerInterceptor in the code; the issue says there is none.

## Fix

No fix: the project is a rolling release, issue #15 is open with no maintainer response. Mitigate by adding Spring Security or a HandlerInterceptor that requires an admin session, restricting state changes to POST, and blocking access from the internet.

## Timeline

- 2026-11-09T11:26:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124590
- 2026-11-09T11:28:24+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-124590 — NVD page unreadable via tools (web-cli out of Exa credits; WebFetch returned only the home page). Read GitHub issue #15, which reports the same commit and unauthenticated admin endpoints incl. /addBook; open, no reply. No vendor fix. Issue is a third-party report, so nothing was marked verified. Issue rates CVSS 9.4; NVD says 7.5, severity unchanged. Public PoC steps are in the issue, but exploitation in the wild is unknown.

## Documents

- [describes] NVD CVE-2026-124590 https://nvd.nist.gov/vuln/detail/CVE-2026-124590
- [poc] Issue #15: Missing authorization on all administrative endpoints https://github.com/zhangbw409/library_manager_system/issues/15

## From the sources

A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_