PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-105611 chillzhuang CVE debrief

A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely.

Vendor
chillzhuang
Product
SpringBlade
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-06
Original CVE updated
2026-10-08
Advisory published
2026-10-06
Advisory updated
2026-10-08

Who should care

Defenders responsible for SpringBlade deployments, particularly those using versions 5.0.0 and 5.0.1, should assess exposure and verify the User Detail Endpoint for improper authorization vulnerabilities.

Why it matters

Defenders should prioritize verifying exposure of SpringBlade versions 5.0.0 and 5.0.1, and assess the User Detail Endpoint for improper authorization vulnerabilities to prevent potential remote attacks.

  • Verify exposure of SpringBlade versions 5.0.0 and 5.0.1 to improper authorization vulnerabilities
  • Assess the User Detail Endpoint for vulnerabilities and implement compensating controls if necessary
  • Monitor for potential remote attacks on the User Detail Endpoint

Technical summary

The vulnerability is located in the RoleController.java file of the SpringBlade system, specifically in the User Detail Endpoint. The manipulation of the ID argument leads to improper authorization, allowing remote attacks. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. Defenders should prioritize verifying exposure of SpringBlade versions 5.0.0 and 5.0.1, and assess the User Detail Endpoint for improper authorization vulnerabilities.

Defensive priority

Defenders should prioritize verifying exposure of SpringBlade versions 5.0.0 and 5.0.1, and assess the User Detail Endpoint for improper authorization vulnerabilities.

Recommended defensive actions

  • Verify exposure of SpringBlade versions 5.0.0 and 5.0.1
  • Assess the User Detail Endpoint for improper authorization vulnerabilities
  • Implement compensating controls to restrict access to the User Detail Endpoint
  • Monitor for potential remote attacks on the User Detail Endpoint
  • Review vendor guidance for SpringBlade
  • Conduct an asset inventory to identify potentially affected systems
  • Track exceptions and retest remediated assets

Evidence notes

The vulnerability was publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. Defenders should verify the User Detail Endpoint for improper authorization vulnerabilities and assess exposure of SpringBlade versions 5.0.0 and 5.0.1. Evidence is limited to public sources and CVE metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-105611 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-105611

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-105611 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105611

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105611.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/413642

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/413642/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-105611

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/989316

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/chillzhuang/SpringBlade/issues/42

    Supplemental source - exploit, issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/chillzhuang/SpringBlade/

    Supplemental source - product

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.