CVE-2026-105610: Improper Authorization in chillzhuang SpringBlade

This vulnerability affects the chillzhuang SpringBlade product up to versions 5.0.0 and 5.0.1. It is caused by improper authorization in an unknown function within blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java, specifically involving the initPassword argument in the Parameter Submit Management component. The flaw allows remote attackers to manipulate this argument to bypass authorization controls. Although the project was notified early, no official fix or response has been issued. A public exploit is available, increasing the risk of exploitation.

Successful exploitation could allow an attacker with some privileges (PR:H) to bypass authorization controls related to password initialization, potentially leading to unauthorized actions within the system. The CVSS 4.0 score of 5.1 (medium) reflects the moderate impact and ease of remote exploitation without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, restrict access to the affected component and limit privileges where possible to reduce exposure.