What is the CVSS score of CVE-2025-52182?

CVE-2025-52182 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of LS2 Admin are affected by CVE-2025-52182?

Library institutions using The Library Corporation LS2 Admin versions 5.7-5.8.0 face risk of unauthorized administrative access due to missing authentication on critical management functions (CVSS…

How to fix or mitigate CVE-2025-52182?

Within 24 hours: Identify and inventory all instances of The Library Corporation LS2 Admin versions 5.7 through 5.8.0 in your environment; immediately restrict network access to all LS2 Admin interfaces via firewall rules or network segmentation, permitting access only from designated administrative networks and IP ranges. Within 7 days: Contact The Library Corporation to confirm patched version availability and expected release timeline; implement additional compensating controls such as reverse proxy authentication, VPN-gating of admin interfaces, or air-gapping of vulnerable systems if operationally feasible. Within 30 days: Upon release of a patched LS2 Admin version, conduct testing in non-production and schedule coordinated deployment across all affected instances; if vendor patch timeline exceeds 30 days, maintain layered network access controls and enable detailed logging and alerting on admin endpoint access.

LS2 Admin CVE-2025-52182

EUVD-2025-210758 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-20 mitre

GHSA-8h4w-q22c-8wqm

Authentication Bypass Information Disclosure N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible export endpoint requires no authentication (PR:N), no complexity, and discloses configuration data (C:H) with no integrity or availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 22:38 vuln.today

CVSS changed

Aug 27, 2026 - 20:37 NVD

7.5 (HIGH)

CVE Published

Aug 20, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Aug 20, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability.

AnalysisAI

Unauthenticated information disclosure in The Library Corporation LS2 Admin (versions 5.7 through 5.8.0) exposes sensitive administrative export endpoints - including location configuration data - to any remote attacker without credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by a CVSS vector of AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag. A GitHub gist reference may document the technique publicly, though confirmed active exploitation is absent from CISA KEV and EPSS sits at a low 0.17% (6th percentile).

Technical ContextAI

LS2 Admin is a web-based library management administration interface developed by The Library Corporation (tlcdelivers.com). The vulnerability class is CWE-306 - Missing Authentication for Critical Function - meaning administrative-tier export routes such as /admin/locationConfiguration/export and functionality surfaced through ExportReportControl.js are reachable without any authentication challenge. The CVSS base vector AV:N/AC:L/PR:N/UI:N confirms the endpoints are network-exposed, require no privileges, no user interaction, and no elevated attack complexity. CPE enumeration is listed as 'n/a' in NVD, indicating the product lacks a formal CPE identifier, which limits automated scanner coverage and asset correlation.

RemediationAI

No vendor-released patch version is identified in available data at time of analysis - patch availability should be confirmed directly with The Library Corporation at tlcdelivers.com. Immediate compensating controls include restricting network access to the /admin/locationConfiguration/export endpoint and related export routes via firewall rules, reverse proxy authentication enforcement, or IP allowlisting to trusted administrative networks only; note that IP allowlisting alone may be insufficient if administrators access the system from dynamic IPs. Disabling or removing the export functionality entirely (if operationally feasible) eliminates the attack surface with no side effects beyond loss of export convenience. The JavaScript resource at /scripts/TlcIndigo/ls2admin/Control/ExportReportControl.js should be audited for additional unauthenticated endpoints. Monitor https://nvd.nist.gov/vuln/detail/CVE-2025-52182 for vendor patch announcements.