CVE-2026-10152: TaleLin lin-cms-spring-boot book Endpoint BookController.java access control
A vulnerability was detected in TaleLin lin-cms-spring-boot up to 0.2.1. This issue affects some unknown processing of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
TaleLin lin-cms-spring-bootfrom your environment.If the TaleLin lin-cms-spring-boot component (or the book endpoint feature) is not required, uninstall or remove it from affected systems until a patch or upstream fix is provided.
- Configuration
Disable the book endpoint in application configuration or in code, or restrict its access (e.g., require authentication/authorization) until an upstream fix is available.
TaleLin lin-cms-spring-boot (BookController book endpoint) book endpoint access = disabled or restricted - Compensating control
Restrict network access to the vulnerable endpoint: block or limit access to the book endpoint at the perimeter (firewall, WAF, API gateway) to trusted IPs or internal networks only, and apply request/URL filtering rules to mitigate remote exploitation.
- Operational
Monitor and audit access logs for signs of exploitation of the book endpoint, deploy intrusion detection signatures for the observed exploit, and perform incident response (including investigating potential compromises). Rotate credentials and secrets only if there is evidence of compromise.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10152?
The severity of CVE-2026-10152 is medium, rated at 6.3.
What type of vulnerability is CVE-2026-10152?
CVE-2026-10152 is an access control vulnerability affecting the book Endpoint in the TaleLin lin-cms-spring-boot.
How do I fix CVE-2026-10152?
To fix CVE-2026-10152, ensure proper access controls are implemented in the BookController.java file.
Which software is impacted by CVE-2026-10152?
CVE-2026-10152 impacts the Talelin lin-cms-spring-boot software versions up to 0.2.1.
What is the impact of CVE-2026-10152?
The impact of CVE-2026-10152 involves improper access controls that could allow unauthorized access to the book Endpoint.