CVE-2026-10152

Vulnerability

A vulnerability exists in TaleLin lin-cms-spring-boot up to version 0.2.1 in the BookController.java file. The POST /v1/book endpoint (line 63) and the PUT /v1/book/{id} endpoint (line 70) lack any permission verification, allowing unauthenticated remote attackers to create arbitrary books and update any existing book's information. The id parameter in the PUT endpoint is predictable and enumerable, enabling attackers to target all stored books [1].

Exploitation

An attacker needs only network access to the vulnerable application. No authentication or prior knowledge is required. For arbitrary book creation, a POST request with a JSON body containing fields like title, author, and summary is sent to /v1/book. For updating any existing book, a PUT request to /v1/book/{id} with the desired fields is sent; the attacker can iterate through sequential id values to modify all books [1]. The exploit is publicly available.

Impact

Successful exploitation allows an attacker to create unauthorized book records and modify the information of any existing book in the database. This results in unauthorized data manipulation, compromising the integrity of the CMS content. No privilege escalation or data disclosure beyond the book entity is described, but the ability to alter stored data can lead to further abuse [1].

Mitigation

As of the publication date, the project maintainers have not responded to the issue report, and no official fix has been released. Users of lin-cms-spring-boot version 0.2.1 or earlier should implement access controls manually, such as adding authentication checks to the affected endpoints, or restrict network access to the application. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1][2].