CVE-2026-96880
mediumA vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1.
A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%83.md cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-96880 cna@vuldb.com
- https://vuldb.com/submit/906081 cna@vuldb.com
- https://vuldb.com/vuln/409078 cna@vuldb.com
- https://vuldb.com/vuln/409078/cti cna@vuldb.com