Lin-CMS Spring Boot EUVD-2026-85785

Requires only network reachability to a lin-cms-spring-boot (<=0.2.1) instance exposing the book/getBooks endpoint; no authentication, no privileges, and no user interaction are needed (PR:N/UI:N). The only meaningful limiting factors are the product's rarity and the fact that impact is confined to unauthorized reading of book records (limited confidentiality, no write or availability effect). No non-default configuration is required - the missing authorization check is in the endpoint logic itself.

This is a real but low-severity issue that should be triaged as low-to-moderate priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates trivial remote unauthenticated access, but impact is narrow: VC:L with VI:N/VA:N means only limited confidentiality loss (unauthorized read of book records via the getBooks endpoint), no integrity or availability impact. The vendor-supplied 6.9 score is inflated relative to that single low-confidentiality impact; an independent CVSS 3.1 read lands closer to ~5.3. Exploitation maturity is E:P (proof-of-concept), and a public POC exists on GitHub, so weaponization is plausible but not confirmed. There is NO EPSS score, NO CISA KEV listing, and no evidence of active exploitation provided - so despite the network/unauthenticated vector, real-world risk is dampened by the product's tiny deployment footprint and the low technical impact. This is a genuine authorization flaw, not a phantom, but it is not a widespread-threat priority.

A remote unauthenticated attacker sends a crafted request to the book (getBooks) endpoint of a lin-cms-spring-boot 0.2.1 instance and, due to a missing authorization check, receives book records they should not be permitted to read. A public proof-of-concept exists (GitHub hhhh333/CVE) demonstrating the unauthorized access, lowering the effort required to reproduce. The low attack complexity and lack of authentication or user interaction make the disclosure trivially repeatable against exposed instances.