SpringBlade versions 2.7.3 through 3.5.0 have a privilege escalation vulnerability allowing authenticated attackers to create system administrator accounts via an unprotected internal user-creation endpoint. The flaw arises from insufficient authorization checks on a Feign endpoint exposed through @RestController and a gateway authentication filter that validates JWT parsing but does not verify user roles or caller identity. Attackers can exploit a hardcoded JWT signing key found in publicly available JARs to forge tokens and escalate privileges, potentially causing cross-tenant data pollution and persistent backdoor access.