This vulnerability in chillzhuang SpringBlade up to version 5.0.2 involves an authorization bypass caused by improper handling of the userId argument in the UserServiceImpl.userInfo function. An attacker can remotely manipulate this argument to gain unauthorized access to user information or functionality that should be restricted. The issue is distinct from other CVEs affecting the product and has been publicly disclosed without vendor remediation or patch availability.

Successful exploitation allows remote attackers to bypass authorization checks in the user-auth-info endpoint, potentially accessing or manipulating user information without proper permissions. This could lead to unauthorized data exposure or actions within the affected system. The impact is rated medium based on the CVSS score and vector, indicating limited but significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected endpoint or implementing additional access controls to mitigate unauthorized access risks.