The vulnerability exists in the BookController.addBook method where manipulation of the parameters userName, userPwd, userEmail, and userId bypasses authorization checks, allowing an attacker to add books without proper credentials. The flaw is categorized as an improper authorization issue under CWE‑266 and CWE‑285 and can be exploited remotely by sending crafted requests to the endpoint.

The affected product is "zhangbw409 library_manager_system". No specific version information is available because the project follows a rolling release model, but the issue was identified in the commit window referenced in the advisory and affects the file src/main/java/com/zbw/controller/UserController.java.

The CVSS score of 6.9 indicates a moderate risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker can launch the exploit from remote hosts as the code is exposed over the network. While the impact is limited to unauthorized data creation, it nonetheless undermines data integrity and could provide a foothold for further privilege escalation.