Medium severity · published Sep 24, 2026
CVE-2026-96882
TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
lin-cms-spring-boot · TaleLin
0.2.0; 0.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-96882
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-96882
vdb-entry
https://vuldb.com/vuln/409080
signature
https://vuldb.com/vuln/409080/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-96882
third-party-advisory
https://vuldb.com/submit/906083
exploit
https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%833.md
More from lin-cms-spring-boot
7.5
CVE-2024-41600
Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in the…
7.5
CVE-2022-32430
An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application
6.3
CVE-2026-10152
TaleLin lin-cms-spring-boot book Endpoint BookController.java access control
5.3
CVE-2026-96881
TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization
5.3
CVE-2026-96880
TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization