The vulnerability identified as CVE-2026-90598 affects the UserController.updateUser function in the jaygajera17 E-commerce-project-springBoot repository up to the specified commit. The flaw allows an attacker to bypass authorization by manipulating the userid argument remotely. The project uses a rolling release model, so no discrete version numbers are provided for affected or fixed states. A pull request containing the fix is awaiting acceptance, indicating no official patch has been released yet. The CVSS v3.1 base score is 6.3, reflecting a moderate severity with network attack vector, low attack complexity, and low privileges required.

Successful exploitation results in an authorization bypass, potentially allowing unauthorized users to update user information. The impact includes limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). The vulnerability is exploitable remotely without user interaction.

No official fix has been released yet; the fix is pending acceptance in a pull request. Users should monitor the repository for the acceptance of this pull request and apply the update promptly once available. Until then, consider restricting access to the UserController.updateUser endpoint or implementing additional authorization checks as a temporary mitigation.