CVE-2026-90598

Received Received - Intake

Authorization Bypass in E-commerce-project-springBoot

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypass. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90598

EUVD

EUVD-2026-77128

Affected Vendors & Products

Vendor	Product	Version / Range
jaygajera17	e-commerce_project_springboot	to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in the UserController.updateUser function of the jaygajera17 E-commerce-project-springBoot application. It allows remote attackers to manipulate the userid argument to gain unauthorized access. The exploit is public and a fix is pending acceptance.

Detection Guidance

This vulnerability involves an authorization bypass in the UserController.updateUser function of the jaygajera17 E-commerce-project-springBoot application. To detect it, inspect network traffic for unauthorized requests modifying the userid parameter in UserController.updateUser calls. Check application logs for unusual user update attempts or access to restricted resources without proper permissions.

Impact Analysis

If you use this vulnerable application, attackers could bypass authorization controls to access or modify user data without proper permissions. This could lead to unauthorized account access, data theft, or other malicious actions depending on the application's functionality.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately review and restrict access to the UserController.updateUser function in the jaygajera17 E-commerce-project-springBoot application. Ensure proper authorization checks are implemented for the userid argument to prevent unauthorized access. Monitor for any unusual activity related to user management functions.

Hi! I’m here to help you understand CVE-2026-90598. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70