JAVA_LIBRARY_MANAGEMENT_SYSTEM · CVE-2026-124621 · Other
NO FIX YET · SEE WHAT TO DO
A Java library management system's Swing admin interface does not check authorization on functions that delete users, change admin passwords, and add, modify or delete books and categories. A remote attacker can perform these admin actions without proper rights, and the exploit has been publicly disclosed.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running this open-source Java/Swing library management project (a hobby-style desktop app) or a copy of it. The issue report says authorization is enforced only in the Swing UI, so any user who can reach the app's backend can perform admin actions: delete users, change admin passwords, and edit books and categories. Whether it is network-reachable depends on how the database is exposed; the README does not say. Anyone not running this project can skip it.
Not affected if not-deployed, not-using-project
Who cares java, library-management, swing
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.