What is the CVSS score of EUVD-2026-53314?

EUVD-2026-53314 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Book-Management-System are affected by EUVD-2026-53314?

Book-Management-System exposes student personal information and library borrowing histories to unauthenticated remote attackers through five unprotected API endpoints.

How to fix or mitigate EUVD-2026-53314?

Within 24 hours: Isolate affected endpoints or restrict network access to known authorized IPs, preserve audit logs, and inventory which student records may have been exposed. Within 7 days: Implement mandatory authentication controls on /student, /record, /books, /find_stu_book, and /find_not_return_book endpoints using the application's existing authentication mechanism, deploy to production, and conduct regression testing. Within 30 days: Complete a full audit of access logs for unauthorized queries, notify affected students if evidence of unauthorized access is found, and conduct application security testing across all remaining endpoints to identify similar gaps.

Book-Management-System EUVD-2026-53314

| CVE-2026-71241 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-05 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-9q89-f4h2-5wx7

Authentication Bypass Python

7.5

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated endpoints with trivial enumeration; impact is confidentiality-only with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 11:38 vuln.today

CVE Published

Aug 05, 2026 - 11:16 cve.org

HIGH 7.5

DescriptionCVE.org

Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. This allows any unauthenticated remote user to retrieve student PII (name, gender, card validity, debt status) and full book-borrowing history by supplying a card_id. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.

AnalysisAI

Five Flask API endpoints in Book-Management-System (/student, /record, /books, /find_stu_book, /find_not_return_book) are missing authentication controls, exposing student PII and borrowing history to any unauthenticated remote caller. Because the card_id parameter is a sequential integer, a trivial enumeration loop can drain the entire student database without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no sophistication and is fully network-accessible.

Technical ContextAI

Book-Management-System is a Python Flask web application implementing a library borrowing management workflow. Flask's routing model requires authentication to be enforced per-route - typically via a decorator such as @login_required from Flask-Login. CWE-306 (Missing Authentication for Critical Function) describes exactly this pattern: the developer correctly applied the decorator to /search_student and /storage but omitted it from five sibling endpoints in the same file. The card_id parameter, described as a sequential integer, eliminates any guessing barrier, reducing exploitation to a simple counter loop. No CPE string was supplied; the affected codebase is identified solely by the GitHub repository at https://github.com/lyric777/Book-Management-System.

RemediationAI

Apply the @login_required decorator (or equivalent authentication guard) to all five affected endpoints - /student, /record, /books, /find_stu_book, and /find_not_return_book - matching the pattern already in use on /search_student and /storage in the same file. Additionally, audit all other routes in the application for the same oversight. As an immediate compensating control while a code fix is prepared, restrict network access to the Flask service to trusted internal hosts via firewall or reverse-proxy ACL; note this does not fix the root cause and prevents legitimate remote use. No formally released patched version has been confirmed at time of analysis - refer to https://github.com/lyric777/Book-Management-System for the latest commits.