CVE-2026-96880: TaleLin lin-cms-spring-boot Auth Bypass

CVE-2026-96880 Overview

CVE-2026-96880 is an improper authorization vulnerability [CWE-266] in TaleLin lin-cms-spring-boot versions up to 0.2.1. The flaw resides in the getBook function within src/main/java/io/github/talelin/latticy/controller/v1/BookController.java, part of the book endpoint. An attacker can manipulate the ID argument to bypass authorization checks and retrieve resources remotely without proper credentials. The exploit has been publicly disclosed, and the vendor did not respond to the disclosure attempt.

Critical Impact

Remote unauthenticated attackers can abuse the book endpoint to access resources that should be restricted by authorization controls, resulting in information exposure.

Affected Products

• TaleLin lin-cms-spring-boot 0.2.0
• TaleLin lin-cms-spring-boot 0.2.1
• All prior versions up to 0.2.1

Discovery Timeline

• 2026-09-24 - CVE-2026-96880 published to the National Vulnerability Database (NVD)
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96880

Vulnerability Analysis

The vulnerability is an improper authorization weakness in the BookController.getBook method of TaleLin lin-cms-spring-boot. The controller accepts a user-supplied ID parameter and returns the corresponding book record without validating whether the requesting principal is authorized to access that specific object.

This pattern aligns with [CWE-266] Incorrect Privilege Assignment and is a form of broken object-level authorization. The endpoint relies on the presence of a valid request path alone rather than enforcing object-scope access checks. Because the attack vector is network-based and requires no authentication or user interaction, exploitation is straightforward.

Root Cause

The root cause is the absence of an authorization check tied to the ID parameter inside getBook. The controller logic resolves the identifier directly to a persistence lookup and returns the result. No session, role, or ownership verification gates the response, which permits enumeration and retrieval of resources that should be access-restricted.

Attack Vector

An attacker issues HTTP requests to the book endpoint while iterating or guessing values for the ID argument. Because the server does not enforce authorization on the targeted object, the response discloses the requested record. The attack is remote, repeatable, and requires only standard HTTP client tooling. A public exploit description is available in the referenced GitHub CVE Report and in the VulDB entry for CVE-2026-96880.

No verified exploit code is reproduced here. Refer to the external advisories above for technical reproduction details.

Detection Methods for CVE-2026-96880

Indicators of Compromise

• Sequential or enumerated requests to /v1/book/{id} with incrementing numeric identifiers from a single source address.
• HTTP 200 responses from the book endpoint originating from unauthenticated sessions or sessions missing expected authorization headers.
• Elevated request volume to BookController endpoints outside normal application usage patterns.

Detection Strategies

• Instrument the application to log every call to getBook with the requesting user identity, source IP, and requested ID value.
• Correlate web server access logs for repeated 2xx responses to /v1/book/* paths from the same client within short time windows.
• Compare request patterns against baseline user behavior to flag identifier enumeration.

Monitoring Recommendations

• Forward application and reverse-proxy logs to a centralized analytics platform and alert on identifier-enumeration signatures.
• Monitor for anomalous outbound data volumes from the application tier that may indicate bulk resource scraping.
• Review authentication and session telemetry for requests reaching the book endpoint without a valid principal context.

How to Mitigate CVE-2026-96880

Immediate Actions Required

• Restrict network access to the lin-cms-spring-boot application at the reverse proxy or WAF layer until a fix is in place.
• Add server-side authorization checks to BookController.getBook that validate the requester's rights against the target ID.
• Rate-limit requests to the book endpoint to inhibit enumeration.

Patch Information

As of publication, the vendor TaleLin has not responded to the disclosure and no official patch is referenced in the advisory. Monitor the TaleLin lin-cms-spring-boot repository and the VulDB vulnerability record #409078 for updates. Until an official patch is released, apply the compensating controls described below.

Workarounds

• Implement a request filter or Spring Security rule that enforces authentication and role verification on every /v1/book/* route.
• Introduce object-level authorization logic that validates the caller's ownership or role before returning book data.
• Deploy a web application firewall rule to block unauthenticated requests to the book endpoint and alert on identifier enumeration.
• Where feasible, replace numeric identifiers with non-sequential UUIDs to reduce enumeration viability while authorization fixes are developed.

# Example nginx reverse-proxy rule to require an auth header on the book endpoint
location ~ ^/v1/book/ {
    if ($http_authorization = "") {
        return 401;
    }
    limit_req zone=book_api burst=10 nodelay;
    proxy_pass http://lin_cms_backend;
}