CVE-2026-71241: Book Management System Auth Bypass Flaw

CVE-2026-71241 Overview

CVE-2026-71241 is a missing authentication vulnerability [CWE-306] in the Book-Management-System Flask application. Five API endpoints (/student, /record, /books, /find_stu_book, and /find_not_return_book) omit the @login_required decorator that protects sibling routes such as /search_student and /storage. Unauthenticated remote attackers can query these endpoints with a card_id parameter to retrieve student personally identifiable information (PII) and complete book-borrowing history. Because card_id values are sequential integers, an attacker can enumerate the full student database without credentials.

Critical Impact
Unauthenticated remote attackers can enumerate the entire student database, exposing names, gender, card validity, debt status, and complete borrowing histories.

Affected Products

Book-Management-System (Flask application published on GitHub)
Endpoints: /student, /record, /books, /find_stu_book, /find_not_return_book
All deployments of the referenced repository without additional access controls

Discovery Timeline

2026-08-05 - CVE-2026-71241 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71241

Vulnerability Analysis

Book-Management-System is a Flask-based library management application. The application uses Flask-Login's @login_required decorator to enforce session-based authentication on routes handling sensitive data. Several sibling routes in the same source file, such as /search_student and /storage, correctly apply this decorator.

Five routes omit the decorator entirely: /student, /record, /books, /find_stu_book, and /find_not_return_book. Each accepts a card_id parameter and returns student records or borrowing history from the backend database. Because Flask evaluates decorators per route, the missing decorator leaves these endpoints reachable by any anonymous client that can connect to the server.

Attackers exploit this by sending HTTP requests with a card_id value and parsing the returned JSON or rendered response. Since card_id values increment sequentially, an attacker can script a loop from card_id=1 upward and harvest the entire student record set. Disclosed fields include name, gender, card validity, debt status, and full borrow history.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306]. Developers applied @login_required inconsistently across routes in the same module. There is no framework-level default that enforces authentication, so any route missing the decorator is publicly reachable.

Attack Vector

Exploitation requires only network access to the application. No credentials, user interaction, or elevated privileges are needed. An attacker sends HTTP GET or POST requests to the vulnerable endpoints with incrementing card_id values and collects the responses. Refer to the Book-Management-System GitHub repository for source-level details of the affected routes.

Detection Methods for CVE-2026-71241

Indicators of Compromise

Anonymous HTTP requests to /student, /record, /books, /find_stu_book, or /find_not_return_book without a valid session cookie
Sequential card_id parameter values in access logs, indicating enumeration
High-volume requests from a single source IP targeting the affected endpoints
Missing Cookie: session=... header on requests that return student data

Detection Strategies

Review Flask access logs for requests to the five vulnerable endpoints where no authenticated session was established
Deploy web application firewall (WAF) rules to log or block unauthenticated requests to these routes
Perform source code review to confirm which routes carry the @login_required decorator

Monitoring Recommendations

Alert on request bursts to /student or /record from unique client IPs exceeding a defined threshold
Monitor for sequential card_id values across short time windows, which indicate enumeration behavior
Ingest Flask application logs into a centralized log platform and build queries around the affected route paths

How to Mitigate CVE-2026-71241

Immediate Actions Required

Add the @login_required decorator to /student, /record, /books, /find_stu_book, and /find_not_return_book route handlers
Restrict application network exposure until the code fix is deployed, using firewall or reverse proxy access controls
Audit application logs for prior unauthenticated access to the affected endpoints and assess potential PII disclosure

Patch Information

No vendor patch is referenced in the CVE record. Operators must apply the fix in source by adding the missing @login_required decorator to each affected route. The Book-Management-System repository contains the vulnerable source for reference.

Workarounds

Place the application behind an authenticating reverse proxy that requires session or SSO login before forwarding requests
Add network-level access control lists (ACLs) restricting the application to trusted internal networks
Replace sequential card_id values with non-guessable identifiers (for example, UUIDs) to reduce enumeration impact

bash

# Configuration example: apply the missing decorator in the Flask route file
# Before:
#   @app.route('/student', methods=['GET', 'POST'])
#   def student():
#       ...
#
# After:
#   @app.route('/student', methods=['GET', 'POST'])
#   @login_required
#   def student():
#       ...