CVE-2026-71241: Book-Management-System: Unauthenticated Disclosure of Student PII and Borrowing History
Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes (/searchstudent, /storage) in the same file. This allows any unauthenticated remote user to retrieve student PII (name, gender, card validity, debt status) and full book-borrowing history by supplying a cardid. Because cardid values are sequential integers, the entire student database can be enumerated without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71241?
The severity of CVE-2026-71241 is rated high with a score of 7.5.
What type of data is disclosed in CVE-2026-71241?
CVE-2026-71241 allows for unauthorized disclosure of student personally identifiable information (PII) and borrowing history.
How do I fix CVE-2026-71241?
To fix CVE-2026-71241, implement the @login_required decorator on the vulnerable Flask API endpoints to restrict access.
Which API endpoints are affected by CVE-2026-71241?
The affected API endpoints in CVE-2026-71241 are /student, /record, /books, /find_stu_book, and /find_not_return_book.
Who is affected by CVE-2026-71241?
Any organization using the Book-Management-System is potentially affected by CVE-2026-71241 due to the risk of unauthorized access to student data.