CVE-2026-97060

Received Received - Intake

X-SpringBoot User Management Authorization Bypass

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-97060

EUVD

EUVD-2026-87254

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

X-SpringBoot through version 6.0 has a flaw where user management endpoints do not verify object-level authorization. This allows sub-administrators with user-management permissions to modify or delete any user account without ownership checks. Attackers can reset passwords for any account including super administrators, change roles, or delete users via specific endpoints like POST /sys/user/update and POST /sys/user/delete.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized modifications to user accounts via specific endpoints. Monitor logs for POST requests to /sys/user/update and /sys/user/delete. Look for requests where non-owner users perform actions like password resets, role changes, or deletions, especially targeting super administrators.

Impact Analysis

If you use X-SpringBoot 6.0 or earlier, an attacker with user-management permissions could take over accounts, including admin accounts, by resetting passwords or changing roles. This could lead to unauthorized access, data breaches, or complete system compromise. The impact depends on the user's privileges and the sensitivity of the data they can access.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates strict access controls for health information. A breach could result in legal penalties, reputational damage, and loss of trust due to unauthorized data exposure or modification.

Mitigation Strategies

Immediately restrict access to /sys/user/update and /sys/user/delete endpoints to only super administrators. Review all recent user modifications for unauthorized changes. Update X-SpringBoot to a patched version if available. Implement strict role-based access controls to prevent sub-administrators from performing sensitive actions.

Hi! I’m here to help you understand CVE-2026-97060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70