This vulnerability exists in the getBooks function of the BookController.java file in TaleLin lin-cms-spring-boot up to versions 0.2.0 and 0.2.1. It allows an attacker to perform unauthorized actions remotely due to improper authorization checks. The vulnerability was publicly disclosed, and the vendor has not provided a response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality with no impact on integrity or availability.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the affected component, potentially gaining unauthorized access to resources or data exposed by the getBooks endpoint. The impact is limited to improper authorization with low confidentiality impact and no integrity or availability impact as per the CVSS vector. No active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is available, consider restricting access to the affected endpoint or implementing additional access controls as a temporary mitigation.