CVE-2026-71241

Name of the Vulnerable Software and Affected Versions Book-Management-System (affected versions not specified)

Description Certain Flask API endpoints lack the @login required decorator, which is used to restrict access to authenticated users. This flaw allows unauthenticated remote users to retrieve student personally identifiable information (PII), including name, gender, card validity, and debt status, as well as complete book-borrowing history. The issue is exploitable via the following endpoints: '/student', '/record', '/books', '/find stu book', and '/find not return book'. By providing the card id variable, which consists of sequential integers, an attacker can enumerate the entire student database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/student', '/record', '/books', '/find stu book', and '/find not return book' endpoints to minimize the risk of exploitation.