CVE-2026-96881: TaleLin lin-cms-spring-boot Auth Bypass

CVE-2026-96881 Overview

CVE-2026-96881 is an improper authorization vulnerability in TaleLin lin-cms-spring-boot through version 0.2.1. The flaw resides in the getBooks function within src/main/java/io/github/talelin/latticy/controller/v1/BookController.java, part of the book endpoint. A remote attacker can invoke the endpoint without proper authorization checks and retrieve data that should require authenticated access. The exploit has been publicly disclosed. The vendor was contacted prior to disclosure but did not respond, meaning no official fix is currently available.

Critical Impact
Remote, unauthenticated attackers can access the book endpoint and retrieve data without passing authorization controls, violating the application's access model [CWE-266].

Affected Products

TaleLin lin-cms-spring-boot versions up to and including 0.2.1
Component: book Endpoint (BookController.java)
Function: getBooks

Discovery Timeline

2026-09-24 - CVE-2026-96881 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96881

Vulnerability Analysis

The vulnerability is categorized under [CWE-266] Incorrect Privilege Assignment. It affects the getBooks controller method in the BookController class of the lin-cms-spring-boot content management framework. The endpoint fails to enforce the authorization checks expected by the application's access model.

As a result, requests reach the controller logic and return book records without validating caller privileges. Because the attack vector is network-based and requires neither authentication nor user interaction, any party able to reach the HTTP endpoint can trigger the behavior. The scope of exposed data is limited to the book endpoint, which constrains impact to confidentiality of that resource.

Root Cause

The root cause is missing or incorrectly applied authorization enforcement on the getBooks handler in src/main/java/io/github/talelin/latticy/controller/v1/BookController.java. The method does not require the privilege level that the application's access model implies for this resource, allowing privileged data to be served to unauthorized callers.

Attack Vector

An attacker issues a standard HTTP request to the book endpoint exposed by a vulnerable lin-cms-spring-boot deployment. No credentials, tokens, or user interaction are required. The server returns book records that should have been protected behind the application's authorization layer. Public proof-of-concept material is available in the GitHub CVE PoC Repository and summarized in the VulDB CVE Summary.

No verified exploit code is reproduced here. Refer to the public references above for technical details of the request pattern.

Detection Methods for CVE-2026-96881

Indicators of Compromise

Unauthenticated HTTP GET requests to the /v1/book route (or equivalent book endpoint) in web server or reverse proxy logs.
Access log entries showing successful 200 responses to the book endpoint from clients that never completed authentication.
Request patterns originating from scanning infrastructure or anonymizing networks targeting the BookController paths.

Detection Strategies

Audit application and web server logs for requests to getBooks endpoints that lack an authenticated session cookie or bearer token.
Deploy a web application firewall (WAF) rule that flags book endpoint responses served without a corresponding authentication event.
Correlate anonymous access to the book endpoint with subsequent high-volume enumeration patterns indicating scraping.

Monitoring Recommendations

Enable verbose access logging for all v1/* controller routes exposed by lin-cms-spring-boot.
Alert on 2xx responses to book endpoints when the authorization header or session cookie is absent.
Track baseline request volumes for the book endpoint and alert on sudden spikes consistent with automated enumeration.

How to Mitigate CVE-2026-96881

Immediate Actions Required

Restrict external exposure of the lin-cms-spring-boot book endpoint using network ACLs or an upstream reverse proxy until a fix is available.
Place the application behind an authenticating gateway that rejects unauthenticated requests to /v1/book paths.
Apply a custom patch to the getBooks method in BookController.java to enforce the required @GroupRequired or equivalent authorization annotation used elsewhere in the project.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted but did not respond. Organizations running lin-cms-spring-boot up to 0.2.1 should maintain a local fork with authorization enforcement added to the getBooks handler, or migrate off the component. Monitor the VulDB Vulnerability Details #409079 entry for updates.

Workarounds

Add server-side authorization middleware in front of the BookController endpoints to require a valid authenticated session.
Disable the book endpoint entirely if the feature is not required by the deployment.
Enforce rate limiting on the vulnerable route to reduce the impact of bulk data extraction.

bash

# Example: block unauthenticated access to the book endpoint at an NGINX reverse proxy
location /v1/book {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://lin_cms_backend;
}