CVE-2026-97368

Deferred Deferred - Pending Action

Authorization Bypass in SpringBlade User Service

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-97368

Affected Vendors & Products

Vendor	Product	Version / Range
chillzhuang	springblade	to 5.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in chillzhuang SpringBlade up to version 5.0.2. It exists in the UserServiceImpl.userInfo function where manipulating the userId argument allows unauthorized access. The flaw enables remote attackers to bypass intended authorization restrictions.

Impact Analysis

An attacker could exploit this to access sensitive user information by manipulating the userId parameter. This could lead to unauthorized data exposure or account takeover. The public availability of an exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to personal data, which is a key concern for GDPR and HIPAA. Organizations using affected SpringBlade versions may face regulatory penalties due to insufficient access controls.

Mitigation Strategies

Update SpringBlade to the latest version beyond 5.0.2 to address the authorization bypass in UserServiceImpl.userInfo. If an update is not available, restrict network access to the affected component or disable the user-auth-info endpoint if not required.

Hi! I’m here to help you understand CVE-2026-97368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70