TheLibrarian’s web_fetch tool can obtain the Adminer interface content, which can then be used to log into the internal backend system. This allows an attacker to bypass normal authentication mechanisms and gain unauthorised access to sensitive administrative resources, potentially exposing confidential data and permitting further malicious actions. The vulnerability relies on improper access control, enabling exploitation without authentication.

The affected product is TheLibrarian.io, a web management platform. All versions currently impacted have been rectified by the vendor; no specific version list is provided, but any installation not upgraded is vulnerable.

The CVSS score of 7.5 indicates a high impact and medium exploitation complexity. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, exploiting the public web_fetch endpoint to retrieve the Adminer content. Once the content is obtained, an attacker can craft a login to the backend, achieving unauthorized access to administrative controls.