Executive brief
A security flaw exists in the TaleLin Lin-CMS Spring Boot framework, which is used to build content management systems. This vulnerability allows unauthorized users to create new book entries or modify existing ones without proper permission. This could lead to unauthorized data manipulation and loss of data integrity within the management system.
Technical details
An improper access control vulnerability (CWE-284/CWE-266) exists in TaleLin lin-cms-spring-boot version 0.2.1 and earlier within the BookController.java component. The endpoints for creating books (POST /v1/book) and updating books (PUT /v1/book/{id}) lack necessary permission verification or authorization checks. A remote attacker with low privileges can exploit these endpoints to inject arbitrary book records or modify existing records by enumerating predictable ID parameters. While the advisory mentions remote exploitability, the CVSS vector indicates low privileges (PR:L) are required. As of the publication date, the project maintainers have not responded to the issue report.
Affected products
- TaleLin lin-cms-spring-boot up to 0.2.1
Timeline
- 2026-05-04: disclosed: Issue reported on GitHub repository
- 2026-05-30: advisory: NVD/VulDB publication date