CVE-2026-97060 yzcheng90 CVE debrief

Who should care

Defenders and administrators of X-SpringBoot through 6.0 systems, particularly those with user management functionality, should assess exposure and prioritize mitigation. This includes reviewing and updating user management permissions to prevent unauthorized actions, verifying and restricting access to user management endpoints, and ensuring proper authorization mechanisms are in place. Additionally, security teams and vulnerability management teams need

Why it matters

CVE-2026-97060 is a high-severity vulnerability in X-SpringBoot through 6.0 that allows sub-administrators to modify or delete users without proper authorization, potentially leading to privilege escalation and unauthorized access.

• Potential unauthorized modification or deletion of user accounts
• Possible escalation of privileges for sub-administrators
• Risk of unauthorized password resets for any account, including the super administrator
• Need for verification of user management permissions and authorization mechanisms

Technical summary

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification via POST /sys/user/update and POST /sys/user/delete endpoints. This vulnerability, with a CVSS score of 8.6, enables attackers with user-management permissions to reset passwords for any account, rebind roles, or delete users. The lack of proper authorization mechanisms in user management endpoints poses a significant risk, as it could lead to unauthorized access and privilege escalation. To mitigate this vulnerability, it is essential to verify and restrict access to these endpoints, ensure proper authorization mechanisms are in place, and

Defensive priority

Defenders should prioritize verifying and mitigating the vulnerability in X-SpringBoot through 6.0, focusing on restricting access to user management endpoints and ensuring proper authorization mechanisms are in place.

Recommended defensive actions

• Verify and restrict access to user management endpoints in X-SpringBoot through 6.0
• Ensure proper authorization mechanisms are in place for user management
• Review and update user management permissions to prevent unauthorized actions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in X-SpringBoot through 6.0, including its description and CVSS score. However, the corpus lacks specific information on affected versions, exploitation, and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.