CVE-2026-56100
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.
Risk Assessment
The risk includes the possibility of full system compromise by an authenticated low-privilege user, which could lead to data integrity violations, unauthorized access to other tenants' data, and persistent attacker presence in the system.
Recommendation
It is recommended to immediately update SpringBlade to version 5.0.0 or later, change the default JWT signing key, and implement proper authorization controls on all internal endpoints.
Other vulnerabilities in SpringBlade
See all- CVE-2026-36765High
An XXE vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.
- CVE-2023-47458Critical
In SpringBlade version 3.7.0 and earlier, a missing permission control framework allows a remote attacker to escalate privileges.
Original NVD description (English source)
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.