CVE-2026-97368 - Vulnerability Details

- chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization

Description

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-24

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a flaw in the SpringBlade user‑auth‑info endpoint that allows an attacker to manipulate the userId argument and bypass normal authorization controls, granting unauthorized access to user information. The bug resides in UserServiceImpl.userInfo and can be triggered remotely by providing malicious input. It is an instance of improper authorization checks, matching CWE‑285 and CWE‑639.

Affected Systems

The affected system is the chillzhuang SpringBlade application, versions up to and including 5.0.2. This applies to the blade-service component, specifically the blade-system module’s UserServiceImpl class used by the user‑auth‑info endpoint.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium impact. EPSS is not available, so the exploitation probability is uncertain, and the vulnerability is not currently listed in the CISA KEV catalog. The attack can be launched remotely; attackers can exploit the bypass by sending crafted requests to the vulnerable endpoint, potentially compromising the confidentiality of other users’ information.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

chillzhuang

SpringBlade

affected

Version	Status	Constraints
`5.0.0`	affected	—
`5.0.1`	affected	—
`5.0.2`	affected	—

No data.

Vendor Product Confidence Versions

Chillzhuang

Springblade

90%

Version	Status	Scheme	Platform
`5.0.0`	affected	semver	—
`5.0.1`	affected	semver	—
`5.0.2`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check the vendor’s website for an official patch that addresses the UserServiceImpl.userInfo authorization issue and upgrade SpringBlade to a fixed version.
Configure network controls to restrict remote access to the user‑auth‑info endpoint, limiting exposure to trusted networks only.
Review and enforce strict input validation on the userId parameter and ensure that role‑based authorization checks are correctly applied before returning user information.

Generated by OpenCVE AI on September 25, 2026 at 03:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.0023.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://aibot88.github.io/CVERequest/SpringBlade/issue2.html
https://vuldb.com/cve/CVE-2026-97368
https://vuldb.com/submit/909894
https://vuldb.com/vuln/409352
https://vuldb.com/vuln/409352/cti

History

Fri, 25 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 24 Sep 2026 20:45:00 +0000

Type	Values Removed	Values Added
Description		A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way.
Title		chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization
First Time appeared		Chillzhuang Chillzhuang springblade
Weaknesses		CWE-285 CWE-639
CPEs		cpe:2.3:a:chillzhuang:springblade::::::::
Vendors & Products		Chillzhuang Chillzhuang springblade
References		https://aibot88.github.io/CVERequest/SpringBlade/issue2.html https://vuldb.com/cve/CVE-2026-97368 https://vuldb.com/submit/909894 https://vuldb.com/vuln/409352 https://vuldb.com/vuln/409352/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Chillzhuang Springblade

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-24T20:30:09.621Z

Updated: 2026-09-25T14:00:52.922Z

Reserved: 2026-09-24T13:58:06.456Z

Link: CVE-2026-97368

Vulnrichment

Updated: 2026-09-25T14:00:49.647Z

NVD

Status : Deferred

Published: 2026-09-24T21:18:58.953

Modified: 2026-09-25T14:17:25.733

Link: CVE-2026-97368

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T09:45:16Z

Weaknesses

CWE-285
Improper Authorization
CWE-639
Authorization Bypass Through User-Controlled Key

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object