Threat Intelligence Database

CVE-2026-105611 is an improper authorization vulnerability in chillzhuang SpringBlade versions 5.0.0 and 5.0.1. It affects a function in the RoleController component related to user detail endpoints. The vulnerability allows remote attackers to manipulate an argument ID to bypass authorization controls. The issue was reported early to the project but has not yet received a response or fix. The vulnerability has a medium severity rating with a CVSS score of 5.1. Exploit code has been publicly disclosed but there are no known exploits in the wild at this time.

CVE-2026-105610 is a medium severity vulnerability in chillzhuang SpringBlade versions 5.0.0 and 5.0.1. It involves improper authorization related to the manipulation of the initPassword argument in the Parameter Submit Management component. The vulnerability can be exploited remotely and a public exploit exists. The vendor has been informed but has not yet responded or provided a fix.

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way.