# CVE-2026-96882: TaleLin lin-cms-spring-boot improper authorization in book search endpoint

Source: https://junglewise.ai/threats/cve-2026-96882-a-vulnerability-was-identified-in-talelin-lin-cms-spring-boot-up  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-96882 · Severity: medium · CVSS 5.3 · Published 2026-09-24

TaleLin lin-cms-spring-boot is a content management system built with Spring Boot. A flaw in the book search endpoint allows unauthenticated attackers to remotely query and view all book records without any authorization checks, exposing potentially sensitive library data.

Technologies: [TaleLin Lin-Cms-Spring-Boot](https://junglewise.ai/threats/technologies/lin-cms-spring-boot). Vendors: [TaleLin](https://junglewise.ai/threats/vendors/talelin).

## Quick answers

**Is CVE-2026-96882 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96882 being exploited in the wild.

**How severe is CVE-2026-96882?** Medium severity, with a CVSS score of 5.3, published 24 September 2026.

**Which products and versions are affected?** TaleLin Lin-Cms-Spring-Boot up to 0.2.1.

**Is there a fix for CVE-2026-96882?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96882 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-96882?** Check whether you run TaleLin Lin-Cms-Spring-Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The searchBook() method in the BookController.java file lacks authentication and authorization checks on the /v1/book/search GET endpoint, allowing unauthenticated remote access. An attacker can directly invoke this endpoint to retrieve all book details from the database without permission. The vulnerability is a classic improper authorization flaw where a sensitive endpoint is exposed without access controls.

## Affected products

- TaleLin lin-cms-spring-boot up to 0.2.1

## Timeline

- 2026-09-24: disclosed
- other: Vendor contacted early but did not respond

## References

- [https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%833.md](https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%833.md)
- [https://vuldb.com/cve/CVE-2026-96882](https://vuldb.com/cve/CVE-2026-96882)

## Related threats

- [TaleLin lin-cms-spring-boot authorization bypass in book endpoint](https://junglewise.ai/threats/cve-2026-96881-a-vulnerability-was-determined-in-talelin-lin-cms-spring-boot-up)
- [TaleLin lin-cms-spring-boot authorization bypass in book endpoint](https://junglewise.ai/threats/cve-2026-96880-a-vulnerability-was-found-in-talelin-lin-cms-spring-boot-up-to-0)
- [TaleLin lin-cms-spring-boot improper access control in BookController](https://junglewise.ai/threats/cve-2026-10152-talelin-lin-cms-spring-boot-improper-access-control-in)