CVE-2026-96880
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability was found in TaleLin lin-cms-spring-boot up to version 0.2.1 in the getBook function of BookController. Manipulation of the ID argument leads to improper authorization. The attack can be performed remotely and the exploit has been published.
Risk Assessment
The organization is exposed to unauthorized access to book functions, potentially leading to data integrity issues or unauthorized operations.
Recommendation
It is recommended to immediately update lin-cms-spring-boot to a version newer than 0.2.1 and monitor logs for suspicious requests to the book endpoint.
Other vulnerabilities in lin-cms-spring-boot
Original NVD description (English source)
A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS