This vulnerability in TaleLin lin-cms-spring-boot up to version 0.2.1 affects the searchBook function in src/main/java/io/github/talelin/latticy/controller/v1/BookController.java. It allows remote attackers to perform actions without proper authorization due to insufficient access control checks. The vulnerability is exploitable remotely and public exploit code exists. The vendor was notified but has not provided any response or fix.

An attacker can remotely exploit this vulnerability to bypass authorization controls on the book endpoint, potentially accessing or manipulating data without proper permissions. The lack of vendor response and available exploit code increases the risk of exploitation. However, no active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing additional access control measures or restricting access to the vulnerable endpoint until an official patch is available.