提交 #989316: chillzhuang SpringBlade 5.0.1 Missing Authorization

chillzhuang SpringBlade 5.0.1 contains a missing authorization vulnerability in the system detail-read functionality. The authenticated GET /user/detail, GET /role/detail, and GET /dept/detail endpoints retrieve records by a client-supplied primary-key identifier without verifying that the requested record belongs to the caller's tenant. Although access to these endpoints requires an authenticated administrative account, the detail handlers do not perform the object-level tenant authorization required before returning the requested record. As a result, an authenticated tenant administrator who knows or obtains another record identifier can read user, role, and department records belonging to other tenants or to the platform tenant. User records may expose sensitive account information including password digests, email addresses, and phone numbers. The issue was reproduced on SpringBlade v5.0.1 at commit 0c180b9d0d68542ab4a2938e23989db7078832ca, where a tenant administrator successfully retrieved the platform administrator's user record and platform-level role and department records.

The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date.

• 来源: ⚠️ https://github.com/chillzhuang/SpringBlade/issues/42
• 用户: cztang (UID 101252)
• 提交: 2026-09-18 04時17分 (18 日前)
• 管理: 2026-10-05 18時22分 (18 days later)
• 状态: 已接受
• VulDB条目: 413642 [chillzhuang SpringBlade 直到 5.0.1 User Detail Endpoint RoleController.java id 权限提升]
• 积分: 20