Is there a public PoC exploit available for CVE-2026-10152?

Yes, a public proof-of-concept exploit is available for CVE-2026-10152. Prioritise patching immediately. EPSS: 0.0%.

lin-cms-spring-boot CVE-2026-10152

Q: What is the CVSS score of CVE-2026-10152?

CVE-2026-10152 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33471 LOW

Improper Access Control (CWE-284)

2026-05-30 VulDB

Authentication Bypass Java Lin Cms Spring Boot Talelin

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 30, 2026 - 20:22 NVD

MEDIUM LOW

CVSS changed

May 30, 2026 - 20:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 30, 2026 - 20:16 vuln.today

CVE Published

May 30, 2026 - 19:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was detected in TaleLin lin-cms-spring-boot up to 0.2.1. This issue affects some unknown processing of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper access control in TaleLin lin-cms-spring-boot through version 0.2.1 allows authenticated remote attackers to bypass authorization enforcement on the book API endpoint, gaining unauthorized read, write, and functional access to book resources. The flaw is rooted in BookController.java and tagged as an authentication bypass, suggesting privilege escalation beyond what the standard CVSS PR:L signal alone implies. A publicly available exploit exists via GitHub issue #336, no vendor patch has been released, and the maintainer has not responded to responsible disclosure - conditions that collectively elevate operational urgency despite the medium CVSS score of 6.3.

Technical ContextAI

lin-cms-spring-boot is a Java Spring Boot content management system developed under the TaleLin project. The vulnerable component is BookController.java at src/main/java/io/github/talelin/latticy/controller/v1/BookController.java, which handles REST API logic for book-related resources under the /v1/book endpoint path. The root cause class is CWE-284 (Improper Access Control), a category covering failures to correctly enforce permission boundaries at the endpoint or object level - a pattern frequently seen in Spring Boot applications where method-level security annotations (@PreAuthorize, @Secured) are missing or misconfigured on individual controller methods, allowing lower-privileged roles to invoke operations intended only for administrators or owners. The CPE cpe:2.3:a:talelin:lin-cms-spring-boot:*:*:*:*:*:*:*:* confirms all versions through 0.2.1 fall within the affected range.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainers have not responded to responsible disclosure submitted via GitHub issue #336, and no fixed version exists. As a primary compensating control, administrators should restrict access to the /v1/book endpoint at the API gateway or reverse proxy layer, limiting requests to trusted roles or internal networks only; this prevents exploitation but disables book management functionality for restricted users. Alternatively, removing or disabling the book module entirely from the deployed instance eliminates the attack surface with the trade-off of losing all book-related CMS features. Organizations should monitor the project repository at https://github.com/TaleLin/lin-cms-spring-boot/ for any maintainer response or patch commit. If Spring Security configuration is accessible, adding explicit method-level @PreAuthorize annotations to BookController methods can serve as a code-level mitigation without waiting for an upstream release, though this requires application-layer access and thorough testing.