---
id: "CVE-2026-124621"
page: "https://infrastack.ai/live/CVE-2026-124621"
kind: "vulnerability"
aliases: ["CVE-2026-124621"]
title: "Java Library Management System: improper authorization in admin functions"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Java_Library_Management_System", "fixed": [], "affected": "all commits up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885 (rolling release)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["java", "library-management", "other", "swing"]
not_affected_if: ["not-deployed", "not-using-project"]
published_at: "2026-11-09T11:17:24+00:00"
first_seen_at: "2026-11-09T11:26:04+00:00"
updated_at: "2026-11-09T11:28:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124621", "first_seen_at": "2026-11-09T11:26:04+00:00"}, {"source": "analyst", "url": "https://github.com/kongxin-github/Java_Library_Management_System/issues/4", "first_seen_at": "2026-11-09T11:28:12+00:00", "cites": ["https://github.com/kongxin-github/Java_Library_Management_System/issues/4", "https://github.com/kongxin-github/Java_Library_Management_System"]}]
exploit_sources: []
---

# Java Library Management System: improper authorization in admin functions

Link for people: https://infrastack.ai/live/CVE-2026-124621 (this .md is for agents)

A Java library management system's Swing admin interface does not check authorization on functions that delete users, change admin passwords, and add, modify or delete books and categories. A remote attacker can perform these admin actions without proper rights, and the exploit has been publicly disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Java_Library_Management_System affected all commits up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885 (rolling release) fixed no fixed version listed

## How to check

Check whether you run a copy or fork of kongxin-github/Java_Library_Management_System at commit 70a6eb6 or later (rolling release, no versions). Look in src/view/MainInterface.java for admin actions (UpdateAdmin.deleteuser, updatepass, Book.addbook, etc.) that rely only on the Swing UI to gate access. Also check whether the app's database (schema mis.sql) is reachable by non-admin users or over the network.

## Fix

No fix: the project is rolling-release, has no published releases, and has not responded to issue #4. Workaround: do not expose the database or app to untrusted users; enforce permissions in the data layer.

## Timeline

- 2026-11-09T11:26:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124621
- 2026-11-09T11:28:12+00:00 analyst https://github.com/kongxin-github/Java_Library_Management_System/issues/4 — NVD (VulDB) only plus repo and issue #4 (opened 2026-10-17, no reply). Repo has no releases or fixes; no versions (rolling release). Network reachability unconfirmed; README has no run instructions. web-cli was out of credits, so only WebFetch used. Nothing verified.

## Documents

- [describes] Authorization enforced only in the Swing UI; all admin functions accessible by any user https://github.com/kongxin-github/Java_Library_Management_System/issues/4
- [mentions] kongxin-github/Java_Library_Management_System repository https://github.com/kongxin-github/Java_Library_Management_System

## From the sources

A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_