CVE-2026-96881 - Vulnerability Details

- TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization

Description

A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-24

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the getBooks endpoint of TaleLin lin‑cms‑spring‑boot allows attackers to bypass normal access controls and view or modify book data without proper privilege. The vulnerability is a classic improper privilege management issue (CWE‑266) and improper authorization (CWE‑285). It can lead to sensitive data exposure and unauthorized changes to the book catalog, and the CVSS score of 6.9 indicates a moderate level of risk.

Affected Systems

TaleLin lin‑cms‑spring‑boot versions up to and including 0.2.1 are impacted. The flaw resides in the BookController.java file’s getBooks endpoint, which can be accessed remotely by any user who can reach the application.

Risk and Exploitability

The vulnerability is exploitable from remote sources and has already been publicly disclosed, meaning attackers can to use it immediately. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, but the combination of remote attack vector, lack of patch availability, and moderate CVSS score suggests a significant risk of unauthorized data access occurring in the wild.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TaleLin

lin-cms-spring-boot

affected

Version	Status	Constraints
`0.2.0`	affected	—
`0.2.1`	affected	—

No data.

Vendor Product Confidence Versions

Talelin

Lin-cms-spring-boot

95%

Version	Status	Scheme	Platform
`0.2.0`	affected	semver	—
`0.2.1`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply any vendor patch that fixes the improper authorization flaw in the getBooks endpoint as soon as it becomes available.
Examine the BookController code and enforce role‑based checks or add a security filter to verify user privileges before returning book data.
Configure the web server to block or redirect requests to the /books endpoint until a fix or patch is applied.

Generated by OpenCVE AI on September 24, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00286.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%832.md
https://vuldb.com/cve/CVE-2026-96881
https://vuldb.com/submit/906082
https://vuldb.com/vuln/409079
https://vuldb.com/vuln/409079/cti

History

Thu, 24 Sep 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 24 Sep 2026 02:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title		TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization
First Time appeared		Talelin Talelin lin-cms-spring-boot
Weaknesses		CWE-266 CWE-285
CPEs		cpe:2.3:a:talelin:lin-cms-spring-boot::::::::
Vendors & Products		Talelin Talelin lin-cms-spring-boot
References		https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%832.md https://vuldb.com/cve/CVE-2026-96881 https://vuldb.com/submit/906082 https://vuldb.com/vuln/409079 https://vuldb.com/vuln/409079/cti
Metrics		cvssV2_0 `{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Talelin Lin-cms-spring-boot

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-24T02:15:10.202Z

Updated: 2026-09-24T13:15:19.061Z

Reserved: 2026-09-23T18:15:07.970Z

Link: CVE-2026-96881

Vulnrichment

Updated: 2026-09-24T13:05:46.627Z

NVD

Status : Deferred

Published: 2026-09-24T03:16:58.333

Modified: 2026-09-24T14:40:36.103

Link: CVE-2026-96881

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-24T03:30:08Z

Weaknesses

CWE-266
Incorrect Privilege Assignment
CWE-285
Improper Authorization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object