| عنوان | chillzhuang SpringBlade 5.0.1 Missing Authorization |
|---|
| الوصف | chillzhuang SpringBlade 5.0.1 contains a missing authorization vulnerability in the system detail-read functionality. The authenticated GET /user/detail, GET /role/detail, and GET /dept/detail endpoints retrieve records by a client-supplied primary-key identifier without verifying that the requested record belongs to the caller's tenant. Although access to these endpoints requires an authenticated administrative account, the detail handlers do not perform the object-level tenant authorization required before returning the requested record. As a result, an authenticated tenant administrator who knows or obtains another record identifier can read user, role, and department records belonging to other tenants or to the platform tenant. User records may expose sensitive account information including password digests, email addresses, and phone numbers. The issue was reproduced on SpringBlade v5.0.1 at commit 0c180b9d0d68542ab4a2938e23989db7078832ca, where a tenant administrator successfully retrieved the platform administrator's user record and platform-level role and department records.
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| المصدر | ⚠️ https://github.com/chillzhuang/SpringBlade/issues/42 |
|---|
| المستخدم | cztang (UID 101252) |
|---|
| ارسال | 18/09/2026 04:17 AM (19 أيام منذ) |
|---|
| الاعتدال | 05/10/2026 06:22 PM (18 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 413642 [chillzhuang SpringBlade حتى 5.0.1 User Detail Endpoint RoleController.java id تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|