CVE-2026-124621 Details

An improper authorization vulnerability has been identified in Kongxin GitHub's Java Library Management System, affecting versions prior to commit 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. The issue arises in the Swing UI layer, specifically within the 'MainInterface.java' file. Several functions, including 'UpdateAdmin.deleteuser', 'UpdateAdmin.updateadmin', 'UpdateAdmin.updatepass', 'Book.addbook', 'Book.modifybook', 'Book.deletebook', 'Category.addcategory', 'Category.setcategory', and 'Landing.sureadmin', lack proper authorization checks. This vulnerability allows remote exploitation, enabling any authenticated user to access administrative functions and manipulate database records.

To address this vulnerability, it is recommended to implement a server-side middleware layer, such as a REST API with role-based access control, between the client and the database. Avoid connecting client applications directly to the database using a superuser account. Instead, use a dedicated low-privilege MySQL user for the application and enforce access controls through stored procedures or a backend service. Additionally, validate user roles on the server side for all privileged operations and remove hardcoded 'root' credentials from the client.