CVE-2026-96882: TaleLin lin-cms-spring-boot Auth Bypass

CVE-2026-96882 Overview

CVE-2026-96882 is an improper authorization vulnerability [CWE-266] affecting TaleLin lin-cms-spring-boot versions up to 0.2.1. The flaw resides in the searchBook function within src/main/java/io/github/talelin/latticy/controller/v1/BookController.java, part of the book Endpoint component. Remote attackers can invoke the affected endpoint without proper authorization checks, exposing book management functionality that should require authenticated access. A public proof-of-concept exploit exists, increasing the likelihood of opportunistic attacks. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Unauthenticated remote attackers can access protected book Endpoint functionality through the searchBook method, bypassing authorization controls in the lin-cms-spring-boot content management framework.

Affected Products

TaleLin lin-cms-spring-boot versions up to and including 0.2.1
Deployments exposing the BookController v1 API endpoint
Applications built on the Lin-CMS Spring Boot framework using the book module

Discovery Timeline

2026-09-24 - CVE-2026-96882 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96882

Vulnerability Analysis

The vulnerability exists in the searchBook function of BookController.java in the v1 API controller tree. The method implementing book search operations lacks the authorization enforcement expected for the endpoint. As a result, callers who should be subject to permission validation can execute the function without providing valid authorization context.

Lin-CMS is a Java content management framework built on Spring Boot. Controllers typically rely on annotation-driven access control or interceptor-based permission validation. When this enforcement is missing or incorrectly configured on a specific route, requests reach the handler and execute business logic unchecked.

This class of flaw is categorized under [CWE-266: Incorrect Privilege Assignment]. The attack can be initiated remotely over the network and requires no user interaction or prior authentication.

Root Cause

The root cause is a missing or improperly applied authorization check on the searchBook controller method. The Lin-CMS permission model relies on annotations and interceptors that must be consistently applied across controller methods. When a route omits the required permission binding, the framework's enforcement layer does not restrict access, exposing the handler to anonymous callers.

Attack Vector

An attacker sends an HTTP request to the vulnerable book search endpoint exposed by BookController. Because the authorization layer does not reject the request, the handler executes and returns data or performs the search operation that should have been gated behind authentication or privileged roles. Exploitation requires only network reachability to the application.

A public proof-of-concept is referenced in the GitHub PoC for Lin-CMS and the VulDB CVE-2026-96882 Entry.

Detection Methods for CVE-2026-96882

Indicators of Compromise

Unauthenticated HTTP requests reaching /v1/book/search or related book Endpoint routes without a valid authorization header or session cookie.
Access log entries showing successful HTTP 200 responses to book search endpoints from untrusted source IP ranges.
Spikes in traffic to BookController endpoints that do not correlate with normal application usage patterns.

Detection Strategies

Review application access logs for requests to book-related v1 API routes that lack Authorization headers or valid session tokens.
Implement web application firewall (WAF) rules that identify anonymous access attempts to Lin-CMS management endpoints.
Correlate request patterns against expected authenticated user flows to surface anomalous unauthenticated API usage.

Monitoring Recommendations

Enable verbose logging on Spring Boot controller invocations to capture caller identity for every book Endpoint request.
Deploy runtime API monitoring that flags endpoints returning data without an authenticated principal.
Alert on repeated requests from a single source IP targeting known Lin-CMS controller paths within short time windows.

How to Mitigate CVE-2026-96882

Immediate Actions Required

Restrict network access to Lin-CMS deployments by placing the application behind an authenticated reverse proxy or VPN until a patch is available.
Apply authorization annotations or interceptor logic to the searchBook method in BookController.java to require valid authentication.
Audit all v1 controller methods in the Lin-CMS codebase for consistent application of permission checks.

Patch Information

No official vendor patch has been published. The vendor did not respond to disclosure attempts according to the VulDB CVE-2026-96882 Entry. Organizations running lin-cms-spring-boot 0.2.1 or earlier should implement source-level fixes by adding authorization annotations to the vulnerable controller methods and rebuilding the application.

Workarounds

Place the application behind an authenticating gateway that enforces session validation before requests reach the Spring Boot backend.
Modify the searchBook handler in BookController.java to include the framework's permission annotation requiring an authenticated login group.
Remove or disable the book Endpoint from public-facing deployments if the functionality is not required.
Add a Spring Security filter or interceptor that globally rejects unauthenticated requests to /v1/book/* routes.

bash

# Example reverse proxy rule to require authentication before reaching Lin-CMS
# nginx snippet - adjust auth_request target to your authentication service
location /v1/book/ {
    auth_request /auth-validate;
    proxy_pass http://lincms_backend;
}

location = /auth-validate {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}