CVE-2026-71241 describes a missing authentication vulnerability (CWE-306) in the lyric777 Book-Management-System. Several Flask API endpoints that expose student PII and borrowing history do not enforce login requirements, unlike other related endpoints. This allows unauthenticated remote attackers to retrieve sensitive information by supplying sequential card_id values, enabling full database enumeration. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No patch or official remediation guidance is currently available.

Unauthenticated remote attackers can access sensitive student personally identifiable information including name, gender, card validity, and debt status, as well as full book-borrowing histories. The use of sequential card_id values allows enumeration of the entire student database. This results in a significant confidentiality breach, but does not affect data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints by implementing authentication controls such as the @login_required decorator. Limit exposure of sensitive endpoints and monitor for unauthorized access attempts.