Lin CMS EUVD-2026-85772

No special conditions - remote unauthenticated exploitation against default configurations of TaleLin lin-cms-spring-boot (<=0.2.1). Exploitation requires only crafting a request to the book endpoint with an altered ID argument; no authentication (PR:N), no user interaction (UI:N), and no non-default settings are needed. Limiting factors are the low impact ceiling (read-only disclosure of book records, no integrity/availability effect) and the product's niche deployment as an open-source CMS scaffold, which sharply constrains the realistic target population.

This is a genuinely low-severity issue despite the network-reachable vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N, score 5.5) reflects unauthenticated remote reachability but only LOW confidentiality impact and NO integrity or availability impact - consistent with CWE-285 improper authorization (an IDOR/BOLA-style flaw) on a single read endpoint (getBook). A public exploit exists (E:P, GitHub PoC by hhhh333), which raises practical accessibility, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The single-source reporting (VulDB only) and unresponsive vendor mean affected-version and impact claims are not independently corroborated. Net: a real but low-priority finding - the public PoC warrants patching where deployed, but the limited impact (read-only info disclosure of book records in what is effectively a demo/scaffold CMS) and niche footprint keep real-world risk modest. Note the 'Authentication Bypass' tag overstates this: CWE-285 is an authorization failure on an object reference, not an authentication bypass.

A remote, unauthenticated attacker sends a request to the /book endpoint while manipulating the ID parameter, causing the getBook handler to return book records the requester should not be authorized to view. A public proof-of-concept exists (GitHub, hhhh333/CVE), lowering the skill required, and the attack needs no special access, user interaction, or non-default configuration.