CVE-2026-97368
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability in chillzhuang SpringBlade up to 5.0.2 affects the UserServiceImpl.userInfo function in the user-auth-info Endpoint component. Manipulation of the userId argument causes authorization bypass, allowing remote attack.
Risk Assessment
An attacker can gain unauthorized access to user information or perform operations without proper permissions, potentially leading to data confidentiality breaches.
Recommendation
Update SpringBlade to the latest version that includes a fix. Also restrict access to the user-auth-info endpoint and monitor logs for suspicious activity.
Other vulnerabilities in SpringBlade
See all- CVE-2026-36765High
An XXE vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.
- CVE-2023-47458Critical
In SpringBlade version 3.7.0 and earlier, a missing permission control framework allows a remote attacker to escalate privileges.
- CVE-2026-56100High
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.
Original NVD description (English source)
A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS