Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that…

CVE-2026-71241 affects the Book-Management-System Flask application, where multiple API endpoints (/student, /record, /books, /find_stu_book, /find_not_return_book) are missing the @login_required decorator. This allows any unauthenticated remote user to access sensitive student PII including names, gender, card validity, and debt status. Full book-borrowing history is also accessible without authentication. The vulnerability is particularly severe because card_id values are sequential integers, enabling complete enumeration of the student database. Sibling routes such as /search_student and /storage are properly protected, indicating inconsistent application of authentication controls. No credentials or special privileges are required to exploit this issue.