This vulnerability exists in the UserController.updateUser function of the jaygajera17 E-commerce-project-springBoot up to commit 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. By manipulating the userid parameter, an attacker can bypass authorization controls remotely. The product employs continuous delivery with rolling releases, so no discrete version numbers are provided for affected or patched states. A pull request containing the fix is pending acceptance. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. Exploit code is publicly available, but no known active exploitation in the wild is reported.

Successful exploitation allows an attacker to bypass authorization controls in the updateUser function, potentially enabling unauthorized modification of user data. The impact is rated medium due to limited scope and low impact on system confidentiality, integrity, and availability as per CVSS metrics.

A fix has been developed and submitted as a pull request but is not yet merged or officially released. Users should monitor the vendor's repository for acceptance of the fix and update accordingly once available. Until then, no official patch is available. No vendor advisory or official remediation guidance is provided. Patch status is not yet confirmed—check the vendor repository for current remediation updates.