CVE-2026-97060
HighCVSS 7.2Summary
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.
Risk Assessment
An attacker with user-management permissions can take over any account, including the super administrator, leading to full system compromise. This may result in unauthorized access, data loss, or privilege escalation.
Recommendation
Update X-SpringBoot to a version later than 6.0 that includes the object-level authorization fix. In the meantime, restrict sub-administrator permissions and monitor for unusual user operations.
Other vulnerabilities in X-SpringBoot
See all- CVE-2026-100192Medium
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
- CVE-2026-97064Critical
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.
- CVE-2026-97063Critical
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
Original NVD description (English source)
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS