| Название | chillzhuang SpringBlade 5.0.1 Missing Authorization |
|---|
| Описание | chillzhuang SpringBlade 5.0.1 contains a missing authorization vulnerability in the system detail-read functionality. The authenticated GET /user/detail, GET /role/detail, and GET /dept/detail endpoints retrieve records by a client-supplied primary-key identifier without verifying that the requested record belongs to the caller's tenant. Although access to these endpoints requires an authenticated administrative account, the detail handlers do not perform the object-level tenant authorization required before returning the requested record. As a result, an authenticated tenant administrator who knows or obtains another record identifier can read user, role, and department records belonging to other tenants or to the platform tenant. User records may expose sensitive account information including password digests, email addresses, and phone numbers. The issue was reproduced on SpringBlade v5.0.1 at commit 0c180b9d0d68542ab4a2938e23989db7078832ca, where a tenant administrator successfully retrieved the platform administrator's user record and platform-level role and department records.
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| Источник | ⚠️ https://github.com/chillzhuang/SpringBlade/issues/42 |
|---|
| Пользователь | cztang (UID 101252) |
|---|
| Представление | 18.09.2026 04:17 (18 дни назад) |
|---|
| Модерация | 05.10.2026 18:22 (18 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 413642 [chillzhuang SpringBlade до 5.0.1 User Detail Endpoint RoleController.java id эскалация привилегий] |
|---|
| Баллы | 20 |
|---|