CVE-2026-105611: SpringBlade Auth Bypass Vulnerability

CVE-2026-105611 Overview

CVE-2026-105611 is an improper authorization vulnerability [CWE-266] affecting chillzhuang SpringBlade through version 5.0.1. The flaw resides in the RoleController.java file located at blade-service/blade-system/src/main/java/org/springblade/system/controller/ within the User Detail Endpoint component. An authenticated attacker can manipulate the ID argument to access resources outside their authorization scope. The exploit has been publicly disclosed and may be leveraged by threat actors. The project maintainers were notified through a GitHub issue report but have not responded.

Critical Impact

Authenticated remote attackers can abuse the User Detail Endpoint to retrieve role or user data belonging to other accounts, undermining tenant isolation in SpringBlade deployments.

Affected Products

• chillzhuang SpringBlade versions up to and including 5.0.1
• blade-service/blade-system module, specifically RoleController.java
• Deployments exposing the User Detail Endpoint to authenticated users

Discovery Timeline

• 2026-10-06 - CVE-2026-105611 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105611

Vulnerability Analysis

The vulnerability stems from inadequate authorization checks within the User Detail Endpoint handled by RoleController.java. SpringBlade is a Java-based microservices rapid development platform built on Spring Cloud. The affected controller accepts an ID argument from the request without validating whether the authenticated caller has permission to view the referenced resource. An attacker who holds valid credentials can supply arbitrary identifiers to enumerate role or user records belonging to other tenants or privilege tiers. The weakness is classified under CWE-266 (Incorrect Privilege Assignment), reflecting a broken access control pattern rather than a memory-safety or injection flaw.

Root Cause

The root cause is the absence of a server-side authorization decision tied to the caller's identity when resolving the ID parameter in the User Detail Endpoint. The controller trusts the client-supplied identifier and returns the corresponding record without comparing it against the authenticated principal's tenant, role, or data scope. This design pattern is a classic Insecure Direct Object Reference (IDOR) condition.

Attack Vector

Exploitation requires network access to the SpringBlade API and valid low-privilege credentials. The attacker issues an authenticated HTTP request to the User Detail Endpoint and iterates the ID parameter to enumerate records. Because the attack is network-reachable and requires no user interaction, automated enumeration of role or user data is practical once an initial foothold account is obtained. No synthetic exploit code is published here; refer to the external references for technical specifics.

See the GitHub Issue #42 and the VulDB entry for CVE-2026-105611 for additional detail on the disclosed behavior.

Detection Methods for CVE-2026-105611

Indicators of Compromise

• Authenticated HTTP requests to the SpringBlade User Detail Endpoint containing sequential or enumerated ID parameter values from a single session or source IP.
• Application logs showing a single user account retrieving role or user records associated with other tenants or administrative accounts.
• Unexpected 200 OK responses to requests referencing identifiers that fall outside the caller's assigned data scope.

Detection Strategies

• Instrument RoleController request handlers to log the authenticated principal, the requested ID, and the owning tenant of the resolved record for correlation.
• Baseline normal per-user access patterns to the User Detail Endpoint and alert on volumetric spikes or breadth of distinct identifiers accessed.
• Review web access logs and API gateway telemetry for patterns indicative of IDOR enumeration against /blade-system/ routes.

Monitoring Recommendations

• Forward SpringBlade application and gateway logs to a centralized analytics platform for cross-session correlation and retention.
• Create alerts for low-privilege accounts accessing records belonging to administrative roles or foreign tenants.
• Track authentication events paired with sudden increases in distinct ID parameters queried per session.

How to Mitigate CVE-2026-105611

Immediate Actions Required

• Restrict external exposure of the SpringBlade User Detail Endpoint to trusted networks or authenticated administrative users only.
• Audit existing SpringBlade accounts and revoke credentials that are no longer required to shrink the pool of potential abusers.
• Review application and gateway logs for signs of prior enumeration against the RoleController endpoint.

Patch Information

No vendor patch is available at the time of publication. The project was informed through a GitHub issue report but has not responded. Monitor the chillzhuang SpringBlade repository and GitHub Issue #42 for updates. Operators should plan to apply a fix as soon as upstream maintainers publish one, or maintain a local fork with authorization checks added.

Workarounds

• Add a server-side authorization filter that compares the authenticated principal's tenant and role against the owner of the record resolved by the ID parameter before returning data.
• Place the /blade-system/ routes behind an API gateway rule that enforces role-based access and rate-limits per-user requests to detail endpoints.
• Where feasible, replace numeric or guessable identifiers with unguessable UUIDs to raise the cost of enumeration while a code-level fix is prepared.

# Example: restrict access to the User Detail Endpoint at the reverse proxy layer
# nginx snippet - allow only internal admin network to reach the vulnerable route
location /blade-system/role/ {
    allow 10.0.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://springblade_upstream;
}