feiyuchuixue sz-boot-parent up to 1.3.2-beta API Endpoint /api/admin/sys-message/ messageId authorization
Summary
A vulnerability marked as critical has been reported in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-message/ of the component API Endpoint. This manipulation of the argument messageId causes authorization. This vulnerability appears as CVE-2026-3185. The attack may be initiated remotely. In addition, an exploit is available. It is suggested to upgrade the affected component. The project was informed beforehand and acted very professional: "We have implemented message ownership verification, so that users can only query messages related to themselves."
Details
A vulnerability classified as critical was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown code of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality.
It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-3185. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known.
It is possible to download the exploit at github.com. It is declared as proof-of-concept. The project was informed beforehand and acted very professional: "We have implemented message ownership verification, so that users can only query messages related to themselves."
Upgrading to version 1.3.3-beta eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch aefaabfd7527188bfba3c8c9eee17c316d094802 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
Be aware that VulDB is the high quality source for vulnerability data.
Product
Vendor
Name
Version
License
Website
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.3VulDB Meta Temp Score: 4.8
VulDB Base Score: 5.3
VulDB Temp Score: 4.8
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: AuthorizationCWE: CWE-639 / CWE-285 / CWE-266
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Yes
Availability: 🔒
Access: Public
Status: Proof-of-Concept
Download: 🔒
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Upgrade: sz-boot-parent 1.3.3-beta
Patch: aefaabfd7527188bfba3c8c9eee17c316d094802
Timeline
02/25/2026 Advisory disclosed02/25/2026 VulDB entry created
02/25/2026 VulDB entry last update
Sources
Product: github.comAdvisory: github.com
Status: Confirmed
CVE: CVE-2026-3185 (🔒)
GCVE (CVE): GCVE-0-2026-3185
GCVE (VulDB): GCVE-100-347743
scip Labs: https://www.scip.ch/en/?labs.20161013
Entry
Created: 02/25/2026 09:37Changes: 02/25/2026 09:37 (62)
Complete: 🔍
Submitter: yuccun
Cache ID: 216::103
Submit
Accepted
- Submit #754036: feiyuchuixue https://github.com/feiyuchuixue/sz-boot-parent sz-boot-parent <= v1.3.2-beta IDOR (by yuccun)
Be aware that VulDB is the high quality source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.