| 제목 | chillzhuang SpringBlade 5.0.1 Missing Authorization |
|---|
| 설명 | chillzhuang SpringBlade 5.0.1 contains a missing authorization vulnerability in the system detail-read functionality. The authenticated GET /user/detail, GET /role/detail, and GET /dept/detail endpoints retrieve records by a client-supplied primary-key identifier without verifying that the requested record belongs to the caller's tenant. Although access to these endpoints requires an authenticated administrative account, the detail handlers do not perform the object-level tenant authorization required before returning the requested record. As a result, an authenticated tenant administrator who knows or obtains another record identifier can read user, role, and department records belonging to other tenants or to the platform tenant. User records may expose sensitive account information including password digests, email addresses, and phone numbers. The issue was reproduced on SpringBlade v5.0.1 at commit 0c180b9d0d68542ab4a2938e23989db7078832ca, where a tenant administrator successfully retrieved the platform administrator's user record and platform-level role and department records.
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| 원천 | ⚠️ https://github.com/chillzhuang/SpringBlade/issues/42 |
|---|
| 사용자 | cztang (UID 101252) |
|---|
| 제출 | 2026. 09. 18. AM 04:17 (18 날 ago) |
|---|
| 모더레이션 | 2026. 10. 05. PM 06:22 (18 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413642 [chillzhuang SpringBlade 까지 5.0.1 User Detail Endpoint RoleController.java id 권한 상승] |
|---|
| 포인트들 | 20 |
|---|