This vulnerability (CVE-2025-15025) affects Yordam Information Technology Consulting's Library Automation System, specifically versions starting at 21.6 up to but not including 22.1. It is an authorization bypass issue caused by improper handling of user-controlled keys, allowing attackers to exploit trusted identifiers (CWE-639). The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor. The system is not a cloud service, so remediation depends on vendor updates or user-applied fixes.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability due to authorization bypass via user-controlled keys. This could allow attackers to perform unauthorized actions or access sensitive data within the Library Automation System. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a patch is available, consider restricting access to the affected versions and applying compensating controls specific to authorization enforcement if possible.