Description
A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-06
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Improper Authorization leading to unauthorized user detail disclosure
Action: Assess Impact
AI Analysis

Impact

SpringBlade's RoleController User Detail Endpoint contains an improper authorization flaw that allows manipulation of the ID parameter to bypass normal privilege checks. An attacker can exploit this to retrieve any user's details, effectively compromising confidential user information. The weakness aligns with CWE-266 (Improper Privilege Management) and CWE-285 (Improper Check of Permissions).

Affected Systems

The vulnerability affects all SpringBlade releases up to and including version 5.0.1. The affected code resides in blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java. Systems running these versions that expose the RoleController endpoint are potentially vulnerable. The component is identified by the CPE cpe:2.3:a:chillzhuang:springblade:*:*:*:*:*:*:*:*.

Risk and Exploitability

The CVSS score of 5.1 categorizes this issue as moderate. The EPSS score is not available, but the publicly disclosed nature and the remote exploitation path suggest that an attacker can initiate the exploit from outside the network. There is currently no listing in CISA KEV, indicating no confirmed large‑scale active exploitation. Administrators should verify whether the RoleController endpoint is exposed and assess the risk accordingly.

Generated by OpenCVE AI on October 6, 2026 at 05:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SpringBlade to a version newer than 5.0.1 once a patch is released.
  • If an upgrade is not immediately possible, restrict access to the RoleController endpoint through application configuration or firewall rules, permitting only authorized administrative clients.
  • Enable logging or monitoring for the User Detail endpoint to detect anomalous ID values and apply rate‑limiting or blocking if suspected exploitation attempts are observed.
  • Consult the project's GitHub issue tracker or vendor advisory for any interim fix or hot‑fix packages.

Generated by OpenCVE AI on October 6, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization
First Time appeared Chillzhuang
Chillzhuang springblade
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:chillzhuang:springblade:*:*:*:*:*:*:*:*
Vendors & Products Chillzhuang
Chillzhuang springblade
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 2.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Chillzhuang Springblade
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-08T02:42:13.034Z

Reserved: 2026-10-05T16:22:31.519Z

Link: CVE-2026-105611

cve-icon Vulnrichment

Updated: 2026-10-08T02:42:07.615Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T04:17:58.950

Modified: 2026-10-08T03:16:34.090

Link: CVE-2026-105611

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T05:30:18Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization