zhangbw409 library_manager_system: Improper authorization via BookController (CVE-2026-124590)
A remote improper authorization vulnerability in zhangbw409 library_manager_system allows attackers to manipulate user-related parameters within the BookController.addBook method to bypass authorization.
CVE search metadata
CVE search record: CVE-2026-124590. Severity: high. CVSS: 7.3. KEV: no. Product: library_manager_system (rolling release). Brief: zhangbw409 library_manager_system: Improper authorization via BookController (CVE-2026-124590). Brief link: https://feed.craftedsignal.io/briefs/2026-11-library-manager-auth-bypass/
Triage facts
Revision 1- Applicability
- library_manager_system (rolling release)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 11:38 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
A vulnerability exists in the library_manager_system project (commit hash f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b) within the BookController.addBook function located in src/main/java/com/zbw/controller/UserController.java. Attackers can remotely exploit this by manipulating the userName, userPwd, userEmail, or userId parameters to perform unauthorized actions. The maintainers have not yet provided a patch for this rolling-release project.
Impact
Successful exploitation allows remote attackers to bypass authorization controls, potentially leading to unauthorized data modification or administrative access depending on the context of the affected system.
Recommendation
- Audit all deployments of the library_manager_system for exposed instances.
- Implement network-level restrictions to limit remote access to the BookController API endpoints.
- Monitor application logs for anomalous POST requests to the addBook method containing unusual characters or unexpected values in user parameter fields.
Immediate actions
Identify and isolate instances of library_manager_system from public-facing segments.
Threat Hunt
Identify suspicious POST requests to the addBook method with anomalous parameter values
Data: Web server access logs
Mitigations
Apply network access control lists (ACLs) to block untrusted traffic to library_manager_system endpoints
CVE-2026-124590