CVE-2026-105611: Improper Authorization in chillzhuang SpringBlade

This vulnerability in chillzhuang SpringBlade up to version 5.0.1 involves improper authorization in the RoleController.java file, specifically in the user detail endpoint. Manipulation of the argument ID parameter allows an attacker to bypass authorization checks remotely. The vulnerability was responsibly disclosed to the project, which has not yet issued a fix or response. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality. Public exploit details exist but no active exploitation is confirmed.

An attacker can remotely bypass authorization controls by manipulating the argument ID in the affected user detail endpoint, potentially gaining unauthorized access to user-related functions or data. The impact on confidentiality is low, and there is no impact on integrity or availability as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, monitor official channels for updates. Until a fix is available, restrict access to the affected endpoint where possible and apply compensating controls to limit unauthorized access.