Submit #971178: Jeebase 0.0.1 Mass Assignment

A mass assignment vulnerability exists in the /user/update/info endpoint of Jeebase 0.0.1. The endpoint requires authentication but does not properly restrict which attributes of the UpdateUser object can be modified by the client.

The controller attempts to construct a restricted UpdateUser object containing only permitted fields and the ID of the currently authenticated user. However, due to an implementation error, the application passes the original client-controlled user object to userService.updateUser(user) instead of the restricted object.

As a result, an authenticated low-privileged user can provide arbitrary attributes, including the ID and password of another user, and modify that user's account. During testing, a normal user was able to change the password of an administrator account and subsequently authenticate as the administrator, resulting in account takeover and privilege escalation.

The vulnerability is caused by improper handling of client-controlled object attributes and can be exploited without interaction from the victim.

• Source: ⚠️ https://github.com/wmz1930/Jeebase/issues/88
• User: mjh_456 (UID 101155)
• Submission: 09/10/2026 11:48 (24 days ago)
• Moderation: 10/04/2026 11:22 (24 days later)
• Status: Accepted
• VulDB entry: 413417 [Jeebase 0.0.1 UserService /user/update/info updateUser user/tempUser dynamically-determined object attributes]
• Points: 20