The vulnerability is an IDOR (Insecure Direct Object Reference) that allows an attacker to supply a user-controlled key to bypass the system’s authorization checks. By manipulating the identifier, an unauthorized individual can access or modify data that should be restricted, potentially exposing sensitive borrower information or altering inventory records. The impact includes loss of data confidentiality and integrity, and a partial break of segregation of duties.

The affected product is Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc.’s Library Automation System. Vulnerable releases span from version 21.6 through any release prior to 22.1.

The CVSS score of 8.8 places this issue in the high severity range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the system’s web interface, where an attacker can supply the vulnerable identifier parameter. Successful exploitation requires an authenticated session, but the IDOR nature means anyone who can interact with the web UI may manipulate the key to gain access to data they are not authorized to view.