Skip to content
OpenAdvisories
Critical VA-26-275-05 1 CVE

Cadmos LTI

Published Oct 1, 2026 · Updated Oct 1, 2026

Vendor: Eummena Product: Cadmos LTI

Summary

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext.

Vulnerabilities 1

  • Critical 9.3
    CVE-2026-102628

    Cadmos LTI exposure of sensitive information via debug mode

    The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Larave…

    Eummena Cadmos LTI

Revision history

  1. #1.0.0

    Initial publication