CVE-2026-102628 describes a vulnerability in the Cadmos LTI application where Laravel's debug mode (APP_DEBUG=true, APP_ENV=local) was enabled in a public environment. An unauthenticated attacker could send a crafted GET request to trigger an unhandled exception, causing Laravel to disclose the full server environment variables in plaintext, including sensitive configuration data from the .env file. This issue is categorized under CWE-215 (Insertion of Sensitive Information Into Debugging Code) and CWE-489 (Exposure of Information Through Debug Information). The vulnerability was addressed with a fix released on or before 2026-09-02.

The vulnerability allows unauthenticated remote attackers to obtain sensitive server environment information, including all .env configuration variables, which may contain credentials, API keys, and other secrets. This exposure can lead to further compromise of the application and underlying infrastructure. The CVSS v3.1 score is 9.3 (critical), reflecting high confidentiality impact, low attack complexity, no privileges or user interaction required, and scope change.

A fix for this vulnerability was released on or before 2026-09-02. It is recommended to ensure Laravel debug mode (APP_DEBUG) is disabled in production environments and to apply the official patch or update provided by the vendor. Since the application is not a cloud service, remediation must be applied by the system administrators. Verify that the environment variables are no longer exposed after applying the fix.