Book-Management-System exposes students’ personally identifiable information and their complete borrowing records through several Flask API endpoints that lack authentication. An attacker can simply provide a student card identifier to view name, gender, card validity, debt status, and all related book‑borrowing actions. Because the identifiers are predictable sequential integers, the entire student database can be enumerated without needing credentials. This vulnerability is a classic example of a missing authentication weakness (CWE‑306) that enables sensitive data exposure.

The affected product is Book-Management-System from lyric777. Specific affected versions are not listed, but any deployment that includes the vulnerable Flask routes is potentially impacted.

The CVSS score of 7.5 signals a high‑severity risk, and the lack of an EPSS score suggests that the exploitation probability is currently unknown but cannot be dismissed. The vulnerability is not recorded in CISA KEV; however, the remote nature of the API and the full enumeration capability make it a serious threat that can be leveraged by unauthenticated users. Attackers can exploit this by issuing simple HTTP GET requests to the exposed endpoints and iterating over sequential identifiers to harvest sensitive data.