The vulnerability in X‑SpringBoot through version 6.0 allows sub‑administrators to modify or delete user accounts without proper ownership verification. By using the POST /sys/user/update and POST /sys/user/delete endpoints, an attacker with user‑management permissions can reset passwords for any account, including that of the super administrator, rebind roles, or delete users entirely. This lack of object‑level authorization is a classic case of authorization bypass (CWE‑639) and can give an attacker full control over the application’s user base and associated privileges.

All installations of X‑SpringBoot that expose the user‑management endpoints to sub‑administrators are affected. The vulnerability is present in version 6.0 and earlier; any deployment that has not been updated beyond this major release and still uses the exposed /sys/user/update and /sys/user/delete routes remains vulnerable.

The CVSS score of 8.6 indicates a high severity impact, and the lack of an EPSS score means that the precise exploitation probability is unknown but the vulnerability is considered highly actionable. The vulnerability is not listed in CISA’s KEV catalog, so no known large‑scale exploitation has been reported yet. It is inferred that the attack vector is remotely accessible via HTTP traffic, potentially requiring only authenticated user‑management credentials and no special privilege escalation beyond that. Given the elevated permissions that sub‑administrators already possess, the risk to the system is significant.