CVE-2026-105611

chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization

View on CVE.org
Published Oct 6, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

SpringBlade's RoleController User Detail Endpoint contains an improper authorization flaw that allows manipulation of the ID parameter to bypass normal privilege checks. An attacker can exploit this to retrieve any user's details, effectively compromising confidential user information. The weakness aligns with CWE-266 (Improper Privilege Management) and CWE-285 (Improper Check of Permissions).

Affected Systems

The vulnerability affects all SpringBlade releases up to and including version 5.0.1. The affected code resides in blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java. Systems running these versions that expose the RoleController endpoint are potentially vulnerable. The component is identified by the CPE cpe:2.3:a:chillzhuang:springblade:*:*:*:*:*:*:*:*.

Risk and Exploitability

The CVSS score of 5.1 categorizes this issue as moderate. The EPSS score is not available, but the publicly disclosed nature and the remote exploitation path suggest that an attacker can initiate the exploit from outside the network. There is currently no listing in CISA KEV, indicating no confirmed large‑scale active exploitation. Administrators should verify whether the RoleController endpoint is exposed and assess the risk accordingly.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SpringBlade to a version newer than 5.0.1 once a patch is released.
  • If an upgrade is not immediately possible, restrict access to the RoleController endpoint through application configuration or firewall rules, permitting only authorized administrative clients.
  • Enable logging or monitoring for the User Detail endpoint to detect anomalous ID values and apply rate‑limiting or blocking if suspected exploitation attempts are observed.
  • Consult the project's GitHub issue tracker or vendor advisory for any interim fix or hot‑fix packages.

Generated by OpenCVE AI on October 6, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization
First Time appeared Chillzhuang
Chillzhuang springblade
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:chillzhuang:springblade:*:*:*:*:*:*:*:*
Vendors & Products Chillzhuang
Chillzhuang springblade
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 2.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 8, 2026, 2:42 AM
Reserved
Oct 5, 2026, 4:22 PM

View source JSON

Updated
Oct 8, 2026, 2:42 AM

JSON

Status
Deferred
Published
Oct 6, 2026, 4:17 AM
Modified
Oct 8, 2026, 3:16 AM

View source JSON

No data.

Updated
Oct 6, 2026, 5:30 AM

JSON