This vulnerability affects the lin-cms-spring-boot project by TaleLin, specifically versions 0.2.0 and 0.2.1. It arises from improper access control enforcement in the book endpoint implemented in src/main/java/io/github/talelin/latticy/controller/v1/BookController.java. The issue allows remote attackers with low privileges to manipulate access controls, potentially leading to unauthorized actions. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation guidance has been published by the vendor as of the publication date. The exploit code is publicly available, increasing the risk of exploitation.

The vulnerability allows remote attackers with low privileges to bypass or manipulate access controls on the book endpoint, potentially leading to unauthorized access or actions within the affected application. The impact is rated medium severity with a CVSS score of 5.3. There are no known exploits in the wild at this time, but public exploit code exists.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided a fix, users should monitor the vendor's channels for updates. Until a fix is released, consider restricting access to the affected endpoints or implementing additional access control checks at the network or application layer as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.