Executive brief
The Library Corporation LS2 Admin is a library management system used for administrative configuration and reporting. A flaw allows unauthenticated users to directly access and download sensitive configuration data—including system paths, module settings, and administrative setup details—by simply requesting a specific export URL without logging in. This exposes internal system architecture and administrative information that could facilitate further attacks.
Technical details
The vulnerability is an incorrect access control flaw (CWE-306) in the `/admin/locationConfiguration/export` endpoint of LS2 Admin versions 5.7 to 5.8.0. The export controller fails to enforce authentication or authorization checks before processing export requests, allowing any unauthenticated remote attacker to trigger a data export via a direct HTTP GET request. An attacker can obtain the response as an XLS file containing internal configuration data such as system paths and module settings. No authentication bypass or special privileges are required; the endpoint is accessible over the network to any user. Patches or updates from the vendor have not yet been released for affected versions.
Affected products
- The Library Corporation LS2 Admin 5.7 to 5.8.0
Timeline
- 2026-08-20: disclosed