CVE-2026-105611
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file RoleController.java in the component User Detail Endpoint. Manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
The risk includes the possibility of unauthorized access to role management functions, which could lead to privilege escalation or data integrity compromise.
Recommendation
Apply available patches or workarounds from the vendor. Restrict access to the User Detail endpoint and monitor logs for unauthorized requests.
Other vulnerabilities in SpringBlade
See all- CVE-2026-36765High
An XXE vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.
- CVE-2023-47458Critical
In SpringBlade version 3.7.0 and earlier, a missing permission control framework allows a remote attacker to escalate privileges.
- CVE-2026-105610Medium
A vulnerability was found in chillzhuang SpringBlade up to 5.0.1 in ParamController.java within the Parameter Submit Management component. Manipulation of the initPassword argument results in improper authorization. The attack can be launched remotely and the exploit has been made public.
- CVE-2026-97368Medium
A vulnerability in chillzhuang SpringBlade up to 5.0.2 affects the UserServiceImpl.userInfo function in the user-auth-info Endpoint component. Manipulation of the userId argument causes authorization bypass, allowing remote attack.
- CVE-2026-56100High
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.
Original NVD description (English source)
A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS