Medium severity · published May 30, 2026
CVE-2026-10152
TaleLin lin-cms-spring-boot book Endpoint BookController.java access control
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was detected in TaleLin lin-cms-spring-boot up to 0.2.1. This issue affects some unknown processing of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
lin-cms-spring-boot · TaleLin
0.2.0; 0.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10152
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10152
github.com
https://github.com/TaleLin/lin-cms-spring-boot/
github.com
https://github.com/TaleLin/lin-cms-spring-boot/issues/336
vuldb.com
https://vuldb.com/submit/818742
vuldb.com
https://vuldb.com/vuln/367405
vuldb.com
https://vuldb.com/vuln/367405/cti
More from lin-cms-spring-boot
7.5
CVE-2024-41600
Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in the…
7.5
CVE-2022-32430
An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application
5.3
CVE-2026-96882
TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization
5.3
CVE-2026-96881
TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization
5.3
CVE-2026-96880
TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization