CVE-2026-71241 Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History
Unauthenticated attackers can enumerate student PII and borrowing history via unprotected Flask API endpoints in the Book-Management-System.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71241?
CVE-2026-71241 is a high-severity missing authorization vulnerability in lyric777 Book-Management-System, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.
Weakness: CWE-306
Which versions are affected by CVE-2026-71241?
How do I fix CVE-2026-71241?
No fix has been published for CVE-2026-71241 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-71241 being exploited?
There is no known exploitation of CVE-2026-71241 in the wild and no public exploit code.
Sources
Also known as GHSA-9q89-f4h2-5wx7.