The vulnerability in the zhanghuanhao LibrarySystem 图书馆管理系统 arises from an incorrect authorization check in the BookController.java module. Attackers can manipulate request parameters to bypass intended access restrictions, thereby gaining privileged access to book‑management functions. The flaw is a classic example of an authorization bypass or improper access control (CWE‑266 and CWE‑284), which threatens the confidentiality and integrity of library catalog data.

This issue impacts the zhanghuanhao LibrarySystem application in all versions up to and including 1.1.1. Systems that have not upgraded beyond that release are potentially exposed. The vulnerability is limited to the BookController component responsible for handling book‑related requests.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity, while the EPSS probability is below 1 percent, pointing to a low chance of exploitation at the time of analysis. It is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Nonetheless, an attacker with remote access could exploit the flaw, given the absence of response from the project maintainers and the public availability of the exploit code.