CVE-2026-105611
Deferred Deferred - Pending Action

Improper Authorization in SpringBlade User Detail Endpoint

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: VulDB

Description
A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105611
EUVD
EUVD-2026-92936

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
chillzhuang SpringBlade 5.0.0
chillzhuang SpringBlade 5.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105611 is an improper authorization vulnerability in chillzhuang SpringBlade up to version 5.0.1. It affects the RoleController.java file where the system fails to validate tenant ownership when fetching user details by ID. This allows remote attackers to access sensitive data across tenants without proper permissions.

Detection Guidance

Check if endpoints like GET /user/detail, GET /role/detail, and GET /dept/detail are accessible without proper tenant isolation. Use tools like curl to test these endpoints with known identifiers and verify if unauthorized data is returned. Example: curl -X GET http://<target>/user/detail?id=<known_id>

Impact Analysis

An attacker with tenant admin access could exploit this to read sensitive user data like password hashes, emails, and phone numbers belonging to other tenants or the platform. This could lead to unauthorized data exposure, cross-tenant account discovery, and offline password attacks.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive personal data. GDPR requires strict data access controls and breach notification, while HIPAA mandates safeguards for protected health information. The exposure of password hashes and personal details could result in regulatory penalties.

Mitigation Strategies

Add tenant validation to all by-ID read endpoints. Remove password digests from API responses. Ensure the MyBatis-Plus tenant interceptor covers all relevant tables. Restrict access to sensitive endpoints and audit logs for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart