CVE-2026-71241 — Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History
Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling…
Published: 2026-08-05 · CVSS: 7.5 · CVSS 3.1
Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7