{"id":"CVE-2026-124621","kind":"vulnerability","aliases":["CVE-2026-124621"],"related":[],"title":"Java Library Management System: improper authorization in admin functions","description":"A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.","summary":"A Java library management system's Swing admin interface does not check authorization on functions that delete users, change admin passwords, and add, modify or delete books and categories. A remote attacker can perform these admin actions without proper rights, and the exploit has been publicly disclosed.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Java_Library_Management_System","fixed":[],"affected":"all commits up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885 (rolling release)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","library-management","other","swing"],"not_affected_if":["not-deployed","not-using-project"],"how_to_check":"Check whether you run a copy or fork of kongxin-github/Java_Library_Management_System at commit 70a6eb6 or later (rolling release, no versions). Look in src/view/MainInterface.java for admin actions (UpdateAdmin.deleteuser, updatepass, Book.addbook, etc.) that rely only on the Swing UI to gate access. Also check whether the app's database (schema mis.sql) is reachable by non-admin users or over the network.","fix":"No fix: the project is rolling-release, has no published releases, and has not responded to issue #4. Workaround: do not expose the database or app to untrusted users; enforce permissions in the data layer.","status":"open","published_at":"2026-11-09T11:17:24+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","triaged_at":"2026-11-09T11:26:32+00:00","updated_at":"2026-11-09T11:28:12+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T11:26:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Java Library Management System: improper authorization in admin functions","impact":"medium","summary":"A Java library management system's Swing admin interface does not check authorization on functions that delete users, change admin passwords, and add, modify or delete books and categories. A remote attacker can perform these admin actions without proper rights, and the exploit has been publicly disclosed.","audience":"developers","category":"other","nicknames":[],"who_cares":["java","swing","library-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker changes admin passwords and edits library records remotely","analyst_note":"Confirm whether any version is fixed and whether the Swing UI is network-reachable; source is NVD only and the project has not responded.","how_to_check":"- unknown","plain_action":"","product_name":"Java_Library_Management_System","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"The flaw is in a student or hobby Java project that uses a Swing desktop interface for admin functions. Teams running a fork or copy of this project should check whether the admin functions in src/view/MainInterface.java are reachable. The sources do not say which deployments exist beyond the repository itself.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4731,"output_tokens":490,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether any version is fixed and whether the Swing UI is network-reachable; source is NVD only and the project has not responded.","search":"'-124621':12A,15A '-2026':11A,14A '/updateadmin.updateadmin/updateadmin.updatepass/book.addbook/book.modifybook/book.deletebook/category.addcategory/category.setcategory/landing.sureadmin':94C '70a6eb6b96fe64575d8051f1a59055bfc5dc5885':87C 'action':62B 'add':48B 'admin':8A,33B,45B,61B 'affect':89C,141C 'approach':133C 'attack':57B,114C 'author':6A,38B,109C 'book':52B 'categori':54B 'caus':107C 'chang':44B 'check':37B 'compon':101C 'continu':135C 'cve':10A,13A 'delet':42B,51B 'deliveri':136C 'detail':139C 'determin':76C 'disclos':72B,122C 'earli':155C 'exploit':68B,111C,118C 'file':97C 'follow':129C 'function':9A,40B,91C 'github':80C 'improp':5A,108C 'inform':151C 'interfac':34B 'issu':158C 'java':1A,16A,20B,27B,81C 'kongxin':79C 'kongxin-github':78C 'layer':104C 'librari':2A,22B,28B,82C 'library':17A 'library-manag':21B 'manag':3A,23B,29B,83C 'management':18A 'manipul':106C 'may':124C 'modifi':49B 'password':46B 'perform':59B 'possibl':116C 'problem':154C 'product':128C 'project':149C 'proper':64B 'provid':147C 'public':71B,121C 'releas':132C,144C 'remot':56B,110C 'report':159C 'respond':163C 'right':65B 'roll':131C 'src/view/maininterface.java':98C 'swing':25B,32B,102C 'system':4A,19A,30B,84C 'ui':103C 'updat':143C 'updateadmin.deleteuser':93C 'updateadmin.deleteuser/updateadmin.updateadmin/updateadmin.updatepass/book.addbook/book.modifybook/book.deletebook/category.addcategory/category.setcategory/landing.sureadmin':92C 'user':43B 'util':126C 'version':138C 'vulner':74C 'without':63B 'yet':164C","nicknames":[],"mitigations":[],"who_affected":"Anyone running this open-source Java/Swing library management project (a hobby-style desktop app) or a copy of it. The issue report says authorization is enforced only in the Swing UI, so any user who can reach the app's backend can perform admin actions: delete users, change admin passwords, and edit books and categories. Whether it is network-reachable depends on how the database is exposed; the README does not say. Anyone not running this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["javalibrarymanagementsystem"],"ptokens":["java","library","management","system"],"labels":["high","java","librarymanagement","other","swing","vendor"],"campaign_type":null,"search_a":"'-124621':12A,15A '-2026':11A,14A 'admin':8A 'author':6A 'cve':10A,13A 'function':9A 'improp':5A 'java':1A,16A 'librari':2A 'library':17A 'manag':3A 'management':18A 'system':4A,19A","search_b":"'action':62B 'add':48B 'admin':33B,45B,61B 'attack':57B 'author':38B 'book':52B 'categori':54B 'chang':44B 'check':37B 'delet':42B,51B 'disclos':72B 'exploit':68B 'function':40B 'interfac':34B 'java':20B,27B 'librari':22B,28B 'library-manag':21B 'manag':23B,29B 'modifi':49B 'password':46B 'perform':59B 'proper':64B 'public':71B 'remot':56B 'right':65B 'swing':25B,32B 'system':30B 'user':43B 'without':63B","search_c":"'/updateadmin.updateadmin/updateadmin.updatepass/book.addbook/book.modifybook/book.deletebook/category.addcategory/category.setcategory/landing.sureadmin':94C '70a6eb6b96fe64575d8051f1a59055bfc5dc5885':87C 'affect':89C,141C 'approach':133C 'attack':114C 'author':109C 'caus':107C 'compon':101C 'continu':135C 'deliveri':136C 'detail':139C 'determin':76C 'disclos':122C 'earli':155C 'exploit':111C,118C 'file':97C 'follow':129C 'function':91C 'github':80C 'improp':108C 'inform':151C 'issu':158C 'java':81C 'kongxin':79C 'kongxin-github':78C 'layer':104C 'librari':82C 'manag':83C 'manipul':106C 'may':124C 'possibl':116C 'problem':154C 'product':128C 'project':149C 'provid':147C 'public':121C 'releas':132C,144C 'remot':110C 'report':159C 'respond':163C 'roll':131C 'src/view/maininterface.java':98C 'swing':102C 'system':84C 'ui':103C 'updat':143C 'updateadmin.deleteuser':93C 'updateadmin.deleteuser/updateadmin.updateadmin/updateadmin.updatepass/book.addbook/book.modifybook/book.deletebook/category.addcategory/category.setcategory/landing.sureadmin':92C 'util':126C 'version':138C 'vulner':74C 'yet':164C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124621","severity":null,"published_at":"2026-11-09T11:17:24+00:00","modified_at":"2026-11-09T11:17:25+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","fetched_at":"2026-11-09T11:26:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124621:2272","url":"https://github.com/kongxin-github/Java_Library_Management_System/issues/4","severity":null,"published_at":"2026-11-09T11:28:12+00:00","modified_at":"2026-11-09T11:28:12+00:00","first_seen_at":"2026-11-09T11:28:12+00:00","fetched_at":"2026-11-09T11:28:12+00:00","note":"NVD (VulDB) only plus repo and issue #4 (opened 2026-10-17, no reply). Repo has no releases or fixes; no versions (rolling release). Network reachability unconfirmed; README has no run instructions. web-cli was out of credits, so only WebFetch used. Nothing verified.","cites":["https://github.com/kongxin-github/Java_Library_Management_System/issues/4","https://github.com/kongxin-github/Java_Library_Management_System"]}],"documents":[{"id":107193,"url":"https://github.com/kongxin-github/Java_Library_Management_System/issues/4","title":"Authorization enforced only in the Swing UI; all admin functions accessible by any user","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":107194,"url":"https://github.com/kongxin-github/Java_Library_Management_System","title":"kongxin-github/Java_Library_Management_System repository","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}