CVE-2026-96880 in lin-cms-spring-boot
Summary
by MITRE • 09/24/2026
A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in TaleLin lin-cms-spring-boot versions up to 0.2.1 represents a critical failure in access control mechanisms within the application's book management module. Specifically, the flaw resides in the getBook function located in the BookController.java file under the src/main/java/io/github/talelin/latticy/controller/v1 directory. This component serves as the primary endpoint for retrieving book-related data from the content management system. The core technical issue is an improper authorization check that allows attackers to manipulate the ID argument passed to this function. By altering the identifier parameter, a malicious actor can bypass intended security restrictions and access resources belonging to other users or administrative sections of the application. This type of flaw is classically categorized under CWE-284 Improper Access Control, which encompasses scenarios where an application fails to enforce proper authorization policies before granting access to sensitive data or functions.
The operational impact of this vulnerability is significant because it enables remote unauthorized access to potentially confidential information stored within the CMS. Since the exploit relies on manipulating a standard HTTP request parameter, it can be executed remotely by any user with network connectivity to the target system. The fact that an exploit has been made public further exacerbates the risk, as it lowers the barrier for entry for less sophisticated attackers who may leverage automated tools or existing proof-of-concept code to scan and compromise vulnerable instances. This situation highlights a severe gap in the security posture of applications relying on this version of the framework, potentially leading to data breaches, privacy violations, and loss of integrity within the content management ecosystem. The lack of response from the vendor upon early contact suggests that users must rely on community-driven patches or manual code modifications rather than official updates for remediation.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1078 Valid Accounts if an attacker uses stolen credentials to exploit the ID manipulation, or more broadly falls under lateral movement and data exfiltration phases depending on the ultimate goal of the attack. The ability to read arbitrary book records can serve as a reconnaissance step for further exploitation within the application. To mitigate this risk, immediate action is required from system administrators and developers maintaining instances of lin-cms-spring-boot. The most effective mitigation involves upgrading to a patched version if one becomes available through alternative channels or community forks that have addressed the issue. In the absence of an official patch, implementing strict input validation on the ID parameter is essential. This includes ensuring that the requested resource ID matches the ownership context of the authenticated user session. Additionally, deploying Web Application Firewalls with rules designed to detect anomalous patterns in identifier manipulation can provide a layer of defense-in-depth while permanent fixes are developed and deployed. Regular security audits focusing on object-level authorization checks across all API endpoints are recommended to prevent similar flaws from persisting in other parts of the application logic.