What happened
CVE-2026-124590 affects <code>zhangbw409 library_manager_system</code>. The reported flaw is improper authorisation associated with the <code>BookController.addBook</code> function and the manipulation of the <code>userName</code>, <code>userPwd</code>, <code>userEmail</code> or <code>userId</code> arguments. The report locates the function in <code>src/main/java/com/zbw/controller/UserController.java</code>. The service can be attacked directly over a network, without prior access or user involvement. The vulnerability has been publicly disclosed and is confirmed as actively exploited. NVD gives it a high severity rating, with a CVSS score of 7.3. The project was informed through an issue report but has not responded. The product uses rolling releases, so specific affected or updated release versions are not available. Patch status has not been stated; the available information does not establish whether a fix exists. Who is affected Organisations running <code>zhangbw409 library_manager_system</code> may be affected, particularly where the service is reachable over a network. The available information does not identify specific affected release versions. The reported flaw concerns improper authorisation; the stated CVSS vector indicates partial impact to confidentiality, integrity and availability. Recommended actions
Restrict network exposure of the service to reduce the opportunity for direct attacks against reachable instances. Place affected deployments behind network segmentation to limit access to the service. Enforce access controls in front of the service to restrict which network traffic can reach it. Check the vendor advisory for fixed versions and apply any applicable vendor-provided updates.
