An improper authorization flaw exists in the Swing UI Layer of kongxin-github's Java_Library_Management_System. The vulnerability manifests through several functions in MainInterface.java—including deleteuser, updateadmin, updatepass, addbook, modifybook, deletebook, addcategory, setcategory, and the Landing.sureadmin routine. An attacker who can invoke these functions is able to perform privileged operations without proper authentication checks, enabling actions such as user removal, privilege escalation, and data manipulation. The flaw is a classic authorization bypass (CWE‑266, CWE‑285).

The vulnerable code is present in every release of the repository up to commit 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. Users running older versions of the Java library management system, or any installation that has not incorporated a newer commit, are affected. The project uses a rolling‑release model and does not publish explicit fixed release dates, so the affected software is generally any local or hosted instance built from the stated commit or earlier.

According to the public data, the CVSS score is 5.3, indicating a moderate risk profile. No EPSS value is published, but the publicly disclosed nature of the exploit and the statement that remote exploitation is possible imply that an attacker could use the vulnerable application over a network or any interface that exposes the Swing UI. The vulnerability is not listed in the CISA KEV catalog, yet its remote impact and absence of an available mitigation path make it a candidate for immediate action in environments where the application is exposed to untrusted users.