Lin CMS CVE-2026-96882

No special conditions - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against the book endpoint's searchBook function in TaleLin lin-cms-spring-boot <=0.2.1, requiring only network reachability to the application. The practical limiting factors are: impact is confined to unauthorized read of book records (VC:L, no integrity or availability effect); the affected software is a niche OSS CMS scaffold with a small deployment base; and no vendor patch exists, so mitigation depends on the operator (access controls, WAF, or upgrading if a community fix appears). Exploitation requires the book endpoint to be network-exposed.

This is a genuinely low-to-moderate real-world risk despite the 6.9 CVSS 4.0 score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a trivially reachable, remote, unauthenticated flaw, but the impact metrics tell the limiting story: only VC:L (low confidentiality) with VI:N/VA:N and no scope change - the flaw exposes unauthorized book records via broken object-level authorization (CWE-285/IDOR), not code execution or full data compromise. SSVC-style signals reinforce a modest priority: E:P (proof-of-concept exploit maturity) and a publicly available POC exist, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or automatable mass exploitation. The dominant risk-reducer is prevalence: lin-cms-spring-boot is a niche open-source CMS scaffold with a tiny production footprint, so aggregate exposure is small. Note a data conflict to verify: the Tags label this 'Authentication Bypass' but the CWE (CWE-285) and description ('improper authorization') describe an authorization flaw, not authentication bypass - treat it as broken authorization. Net: real but low-severity, appropriate for routine patching rather than emergency response.

A remote, unauthenticated attacker sends a crafted request to the book endpoint's searchBook function and, because the endpoint fails to enforce object-level authorization, retrieves book records they should not be able to access. A public proof-of-concept exists (GitHub hhhh333/CVE) demonstrating the unauthorized access, lowering the skill barrier. Low attack complexity (AC:L) and no required privileges or user interaction make the request itself trivial, though impact is limited to disclosure of low-sensitivity book data.