TaleLin lin-cms-spring-boot Improper Authorization

Improper authorization in TaleLin lin-cms-spring-boot 0.2.1 and earlier lets remote unauthenticated attackers read book records they are not entitled to by manipulating the ID argument supplied to the BookController.getBook endpoint (CWE-285, an object-level authorization gap equivalent to an IDOR). Exploitation requires no authentication, no user interaction and no non-default configuration, and publicly available exploit code exists, though the impact ceiling is low - read-only disclosure of book data with no integrity or availability effect. The issue is not listed in CISA KEV, and the maintainer did not respond to the VulDB disclosure, so no patched version has been identified.

Unauthorized read access to book records in TaleLin lin-cms-spring-boot 0.2.1 and earlier is possible through the searchBook function in BookController.java; remote unauthenticated attackers can reach the book endpoint and retrieve records without proper authorization. A publicly available exploit exists, but there is no confirmed active exploitation (CISA KEV) and no vendor patch identified. The 6.9 CVSS 4.0 score reflects a confidentiality-only impact; our assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, making real-world risk low-to-moderate and dependent on whether the book endpoint is network-exposed.

Improper authorization in TaleLin lin-cms-spring-boot through 0.2.1 lets unauthenticated remote attackers read book records by invoking the getBooks function in BookController.java; the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) confirms no privileges or user interaction are required, and impact is limited to confidentiality. Publicly available exploit code exists, and the vendor did not respond to early disclosure, so no vendor-released patch was identified at time of analysis. This is a real but low-severity issue that should be triaged as low-to-moderate priority, with the primary limiting factors being the product's rarity and the read-only scope of the exposure.