A flaw in the Parameter Submit Management component of SpringBlade allows manipulation of the initPassword argument in ParamController.java, bypassing necessary authorization checks. By supplying a crafted initPassword value, an attacker could alter system settings or perform other privileged actions, compromising the integrity of application configuration and potentially leaking or modifying sensitive data. The weakness is a classic improper authorization scenario that can elevate an unauthenticated or low‑privileged user to higher control over the system.

SpringBlade version 5.0.1 and all earlier releases are affected. The vulnerability resides in blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java and targets the Parameter Submit Management functionality.

The CVSS base score is 5.1, indicating moderate severity. EPSS data is not available, so the precise likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is a remote HTTP request to the vulnerable endpoint, and any user with network access to the application can attempt exploitation. The publicly available exploit makes this weakness a practical concern for organizations running the affected versions.