Cpe:2.3:a:zhangbw409:library_manager_system:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3azhangbw409library_manager_system/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 11:38:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgzhangbw409 library_manager_system: Improper authorization via BookController (CVE-2026-124590)https://feed.craftedsignal.io/briefs/2026-11-library-manager-auth-bypass/Mon, 09 Nov 2026 11:38:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-library-manager-auth-bypass/A remote improper authorization vulnerability in zhangbw409 library_manager_system allows attackers to manipulate user-related parameters within the BookController.addBook method to bypass authorization.A vulnerability exists in the library_manager_system project (commit hash f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b) within the BookController.addBook function located in src/main/java/com/zbw/controller/UserController.java. Attackers can remotely exploit this by manipulating the userName, userPwd, userEmail, or userId parameters to perform unauthorized actions. The maintainers have not yet provided a patch for this rolling-release project.

Impact

Successful exploitation allows remote attackers to bypass authorization controls, potentially leading to unauthorized data modification or administrative access depending on the context of the affected system.

Recommendation

  • Audit all deployments of the library_manager_system for exposed instances.
  • Implement network-level restrictions to limit remote access to the BookController API endpoints.
  • Monitor application logs for anomalous POST requests to the addBook method containing unusual characters or unexpected values in user parameter fields.
]]>mediumadvisoryauthorization-bypassweb-applicationjava