Book‑Management‑System’s Flask API exposes several endpoints—/student, /record, /books, /find_stu_book, and /find_not_return_book—without the @login_required decorator, whereas sibling routes in the same file are protected. The omission allows an unauthenticated attacker to retrieve sensitive personal data and borrowing history of students. Because the student identifiers are sequential integers, a single attacker can enumerate the entire database by incrementally querying these endpoints. The weakness is a missing authentication flaw (CWE‑306), leading to direct confidentiality disclosure of personally identifiable information.

The impacted product is Book‑Management‑System from the vendor lyric777. All deployments that include the vulnerable Flask routes are susceptible; the affected versions are not specified in the advisory, so any installed instance of the application is at risk until authentication controls are applied.

The CVSS score of 7.5 signals a high severity, and the EPSS score of < 1% indicates a low exploitation probability as of this assessment. The vulnerability is not listed in CISA KEV, yet the remote RESTful nature of the API makes it accessible to any network‑connected user. Based on the description, it is inferred that an attacker can send simple HTTP GET requests to the exposed endpoints and iterate over sequential identifiers to harvest sensitive data. Adding a vendor check for any firmware or code base updates is a recommended best practice to stay ahead of mitigations.