CVE-2026-124590— zhangbw409 library_manager_system UserController.java BookController.addBook improper authorization

Quick assessment

Affected

zhangbw409 library_manager_system

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在项目（提交哈希：f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b / 56514767a5207caf5e04c2cea379dfaa8cb5f00b）中发现了一个安全漏洞。该漏洞影响文件中的函数。攻击者可通过操纵、、或参数，导致权限校验不当（即非授权访问）。该攻击可远程发起，且利用方法已在公开渠道披露，可能被恶意利用。该项目采用滚动发布模式以持续提供更新，因此无法提供受影响或已修复版本的具体版本信息。项目方已通过问题报告（Issue）较早获知此漏洞，但截至目前尚未

CVSS 7.3 · High Updated Nov 09, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

zhangbw409 library_manager_system UserController.java BookController.addBook improper authorization

Source: CVE Program / CVE List V5

Vulnerability Description

A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
zhangbw409	library_manager_system	56514767a5207caf5e04c2cea379dfaa8cb5f00b	`cpe:2.3:a:zhangbw409:library_manager_system::::::::`

II. Public POCs for CVE-2026-124590

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124590

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-124590 (1)

CVE-2026-124590 | zhangbw409 library_manager_system UserController.java BookController.addBook userName/userPwd/userEmail/userId improper authorization (Issue 15) vdb-entry technical-description

Other References for CVE-2026-124590 (5)

https://github.com/zhangbw409/library_manager_system/ product
https://github.com/zhangbw409/library_manager_system/issues/15 exploit issue-tracking
https://vuldb.com/cve/CVE-2026-124590 third-party-advisory
https://vuldb.com/vuln/433014/cti signature permissions-required
https://vuldb.com/submit/1040539 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124590

IV. Related Vulnerabilities

Same weakness: CWE-285