| タイトル | chillzhuang SpringBlade 5.0.1 Missing Authorization |
|---|
| 説明 | chillzhuang SpringBlade 5.0.1 contains a missing authorization vulnerability in the system detail-read functionality. The authenticated GET /user/detail, GET /role/detail, and GET /dept/detail endpoints retrieve records by a client-supplied primary-key identifier without verifying that the requested record belongs to the caller's tenant. Although access to these endpoints requires an authenticated administrative account, the detail handlers do not perform the object-level tenant authorization required before returning the requested record. As a result, an authenticated tenant administrator who knows or obtains another record identifier can read user, role, and department records belonging to other tenants or to the platform tenant. User records may expose sensitive account information including password digests, email addresses, and phone numbers. The issue was reproduced on SpringBlade v5.0.1 at commit 0c180b9d0d68542ab4a2938e23989db7078832ca, where a tenant administrator successfully retrieved the platform administrator's user record and platform-level role and department records.
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| ソース | ⚠️ https://github.com/chillzhuang/SpringBlade/issues/42 |
|---|
| ユーザー | cztang (UID 101252) |
|---|
| 送信 | 2026年09月18日 04:17 (18 日 ago) |
|---|
| モデレーション | 2026年10月05日 18:22 (18 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413642 [chillzhuang SpringBlade 迄 5.0.1 User Detail Endpoint RoleController.java id 特権昇格] |
|---|
| ポイント | 20 |
|---|