CVE-2026-97060 is an authorization bypass vulnerability in yzcheng90's X-SpringBoot product affecting versions up to 6.0. The vulnerability arises because the application lacks object-level authorization checks in its user management endpoints. As a result, attackers with user-management privileges can perform unauthorized actions such as resetting passwords, modifying roles, or deleting any user account, including the super administrator, through the POST /sys/user/update and POST /sys/user/delete endpoints.

An attacker with user-management permissions can escalate their control by resetting passwords for any user, including the super administrator, reassigning roles, or deleting user accounts without ownership verification. This can lead to full compromise of user accounts and potentially the entire system's administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user-management permissions strictly to trusted administrators and monitor for suspicious activity involving user management endpoints.