CVE-2026-124590: zhangbw409 library_manager_system UserController.java BookController.addBook improper authorization
A security vulnerability has been detected in zhangbw409 librarymanagersystem f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied severity vector. Exploitation involves manipulating the userName, userPwd, userEmail, or userId arguments associated with BookController.addBook.
Which deployments should be treated as potentially affected?
Deployments of zhangbw409 library_manager_system containing the identified code should be treated as potentially affected, particularly the BookController.addBook functionality in src/main/java/com/zbw/controller/UserController.java. Specific affected or fixed release versions are not available because the project uses a rolling release model.
Is public exploitation material available?
Yes. A public exploit has been disclosed, and the record indicates it may be used.
What should teams do if no update is available?
The provided data does not identify a vendor fix or workaround, and the project has not responded to the reported issue. Prioritize restricting remote access to the affected functionality and review use of the listed user-controlled arguments in the add-book workflow.