CVE-2026-105611
chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 6, 2026
- Updated
- Oct 8, 2026
- Reserved
- Oct 5, 2026
Description
A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 2.7 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 3.0 | 2.7 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 2.0 | 3.3 Low | AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
SpringBladechillzhuang |
|
References
- VDB-413642 | chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorizationvdb-entrytechnical-description
- VDB-413642 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-105611 | CVE Analysis and Reportthird-party-advisory
- Submit #989316 | chillzhuang SpringBlade 5.0.1 Missing Authorizationthird-party-advisory
- https://github.com/chillzhuang/SpringBlade/issues/42exploitissue-tracking
- https://github.com/chillzhuang/SpringBlade/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.