CVE-2026-96882 affects TaleLin lin-cms-spring-boot versions up to 0.2.1 in the searchBook function within src/main/java/io/github/talelin/latticy/controller/v1/BookController.java. The vulnerability results in improper authorization, allowing remote attackers to exploit the flaw without privileges or user interaction. Public exploit code exists, but the vendor has not issued any response or patch. The CVSS 3.1 base score is 5.3, indicating medium severity, with an attack vector of network, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality loss, with no integrity or availability impact.

The vulnerability allows remote attackers to bypass authorization controls in the searchBook endpoint, potentially exposing confidential information. There is no impact on integrity or availability. Exploitation requires no privileges or user interaction, increasing the risk of unauthorized data access. However, no active exploitation in the wild has been reported.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor the vendor's channels for updates. Until a fix is released, consider restricting access to the affected endpoint or implementing additional access controls as a temporary mitigation.