CVE-2026-10152: lin-cms-spring-boot Auth Bypass Flaw

CVE-2026-10152 Overview

CVE-2026-10152 is an improper access control vulnerability in TaleLin lin-cms-spring-boot through version 0.2.1. The flaw resides in the book endpoint handler at src/main/java/io/github/talelin/latticy/controller/v1/BookController.java. An authenticated remote attacker can manipulate the endpoint to perform actions outside the intended authorization boundary. The weakness is categorized under CWE-266: Incorrect Privilege Assignment. Public exploit details have been disclosed, and the upstream project has not responded to the issue report at the time of publication.

Critical Impact
Authenticated remote users can interact with the book endpoint in ways the application's authorization model was not designed to allow, affecting confidentiality, integrity, and availability of managed resources.

Affected Products

TaleLin lin-cms-spring-boot versions up to and including 0.2.1
Component: book Endpoint (BookController.java)
Deployments exposing the affected REST API to untrusted networks

Discovery Timeline

2026-05-30 - CVE-2026-10152 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10152

Vulnerability Analysis

The vulnerability stems from missing or insufficient authorization checks within the BookController class of the lin-cms-spring-boot content management system. Operations exposed through the book REST endpoint do not consistently verify whether the authenticated principal holds the privileges required to invoke them. As a result, a low-privileged user can issue requests that should be restricted to higher-privileged roles. The issue is network-reachable and requires only low-level credentials with no user interaction.

Because lin-cms-spring-boot is a Spring Boot reference application widely forked for learning and demonstration, the flaw can propagate into derivative projects that reuse the same controller logic without hardening.

Root Cause

The root cause is incorrect privilege assignment in the request-handling methods of BookController.java. The controller relies on weak or absent authorization annotations and trusts request-level inputs rather than enforcing role-based checks server-side. This pattern places privilege decisions in code paths that an attacker can influence through normal API parameters.

Attack Vector

The attack is launched over the network against the exposed /v1/book endpoint. An attacker must hold valid low-privilege credentials, after which crafted HTTP requests to the affected handler methods can perform book resource operations that should require elevated rights. No social engineering or local access is necessary. The vulnerability mechanism is described in the public GitHub Issue Tracker #336 and the VulDB Vulnerability #367405 entries.

Detection Methods for CVE-2026-10152

Indicators of Compromise

HTTP requests to /v1/book endpoints from accounts that should not have write or administrative scope on the book resource.
Unexpected create, update, or delete operations recorded in application logs against book records.
Spikes in 4xx to 2xx transitions on the book endpoint indicating successful authorization bypass attempts after probing.

Detection Strategies

Audit Spring Boot access logs for repeated requests to BookController methods originating from low-privileged session tokens.
Compare effective user roles against the operations performed on the book resource and flag mismatches.
Implement web application firewall (WAF) rules that correlate authenticated session role with the HTTP method invoked on /v1/book.

Monitoring Recommendations

Enable verbose authorization logging in the Spring Security filter chain to capture allow and deny decisions per request.
Forward application and access logs to a centralized analytics platform for anomaly detection on the book endpoint.
Alert on any administrative book operations performed outside of approved change windows or by unexpected principals.

How to Mitigate CVE-2026-10152

Immediate Actions Required

Restrict network exposure of the lin-cms-spring-boot API to trusted internal users until a fix is available.
Disable or proxy the /v1/book endpoints behind a reverse proxy that enforces role-based access at the gateway layer.
Review existing accounts and revoke unnecessary low-privilege tokens that could be abused against the controller.

Patch Information

No vendor patch is referenced in the published advisory. The upstream project was notified through the GitHub Issue Tracker #336 but has not responded. Consult the GitHub Project Repository for updates and the VulDB Vulnerability #367405 record for tracking remediation status.

Workarounds

Add explicit @PreAuthorize or equivalent Spring Security annotations to every method in BookController.java and validate roles server-side.
Enforce authorization checks at an upstream API gateway or service mesh policy layer to compensate for the application-level gap.
Limit account provisioning so that only trusted users can authenticate, reducing the population able to reach the vulnerable endpoint.
Fork and self-patch the controller if your deployment depends on lin-cms-spring-boot, ensuring resource ownership checks precede any mutating action.

bash

# Example reverse proxy rule to restrict the book endpoint to admin role header
# (apply at gateway after authenticating the JWT and mapping roles)
location /v1/book {
    if ($jwt_claim_role != "admin") { return 403; }
    proxy_pass http://lin-cms-backend;
}