CVE-2026-3186: Sz-boot-parent Auth Bypass Vulnerability

CVE-2026-3186 Overview

A vulnerability has been identified in szadmin sz-boot-parent up to version 1.3.2-beta affecting the Password Reset Handler component. The vulnerability exists in the /api/admin/sys-user/reset/password/ endpoint, where manipulation of the userId argument allows attackers to reset user passwords to a default value without proper authorization. This is an Authorization Bypass vulnerability that can be exploited remotely over the network.

Critical Impact

Attackers can remotely reset any user's password to a default value by manipulating the userId parameter, potentially gaining unauthorized access to administrative accounts and compromising the entire application.

Affected Products

• szadmin sz-boot-parent versions 1.0.0-beta through 1.3.2-beta
• All beta releases prior to version 1.3.3-beta
• Deployments using the vulnerable /api/admin/sys-user/reset/password/ endpoint

Discovery Timeline

• 2026-02-25 - CVE-2026-3186 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-3186

Vulnerability Analysis

This Authorization Bypass vulnerability stems from the lack of proper access control validation in the password reset functionality. The Password Reset Handler at /api/admin/sys-user/reset/password/ fails to verify whether the requesting user has the necessary permissions to reset passwords for the specified userId. This allows any authenticated user (or potentially unauthenticated users, depending on the endpoint's authentication requirements) to reset passwords for arbitrary user accounts.

When a password reset request is processed, the application accepts the userId parameter without validating the requester's authorization level. The system then resets the target user's password to a default value, effectively allowing an attacker to take over any user account, including administrator accounts.

Root Cause

The root cause is classified as CWE-1393 (Use of Default Password). The password reset interface lacked authorization validation, allowing any user to invoke the password reset functionality for any account. The application would accept requests to reset passwords without verifying that the requesting user had the appropriate administrative privileges to perform this sensitive operation.

Attack Vector

The attack can be initiated remotely over the network. An attacker with network access to the vulnerable application can craft HTTP requests to the /api/admin/sys-user/reset/password/ endpoint, specifying a target userId parameter. The exploit has been publicly disclosed. The attack flow involves:

1. Identifying a valid userId value for a target account
2. Sending a password reset request with the manipulated userId parameter
3. The system resets the target user's password to a default value
4. The attacker can then authenticate using the default password

The security patch added authorization validation to ensure only users with the corresponding permissions can perform password resets:

    EXISTS(1001, "已存在"),
    NOT_EXISTS(1002, "不存在"),
    FILE_NOT_EXISTS(1003, "文件不存在"),
-    FILE_UPLOAD_EXT_ERROR(1004, "上传文件类型错误"),
+    FILE_UPLOAD_EXT_ERROR(1004, "文件类型不被允许，请检查文件扩展名和MIME类型"),
    FILE_UPLOAD_SIZE_ERROR(1005, "上传文件大小不能超过10MB"),
    FILE_UPLOAD_ERROR(1006, "上传文件失败"),
    USERNAME_EXISTS(1007, "用户名已存在"),

Source: GitHub Commit Details

Detection Methods for CVE-2026-3186

Indicators of Compromise

• Unusual HTTP requests to /api/admin/sys-user/reset/password/ with varying userId parameters from the same source
• Multiple password reset events for different user accounts in a short time period
• Failed login attempts followed by successful password reset requests
• Authentication logs showing logins using default credentials after password reset events

Detection Strategies

• Monitor access logs for requests to the /api/admin/sys-user/reset/password/ endpoint, particularly from non-administrative users
• Implement alerting for password reset events, especially when the target user differs from the authenticated user
• Review authentication logs for patterns indicating account takeover via default password usage
• Deploy web application firewall (WAF) rules to detect and block unauthorized password reset attempts

Monitoring Recommendations

• Enable detailed logging for all password reset operations including requester identity and target userId
• Set up alerts for password reset events affecting administrative or privileged accounts
• Monitor for anomalous authentication patterns following password reset events
• Implement rate limiting on the password reset endpoint to detect enumeration attempts

How to Mitigate CVE-2026-3186

Immediate Actions Required

• Upgrade to sz-boot-parent version 1.3.3-beta or later immediately
• Audit all user accounts for unauthorized password changes
• Force password reset for all users, especially administrative accounts
• Review access logs for evidence of exploitation prior to patching

Patch Information

The vulnerability is addressed in version 1.3.3-beta. The patch (commit hash: aefaabfd7527188bfba3c8c9eee17c316d094802) adds authorization validation to the password reset interface, ensuring only users with the corresponding permissions can perform password resets.

The fix can be obtained from the GitHub Release Tag v1.3.3-beta. The specific patch is available at the GitHub Commit Details.

Workarounds

• Implement network-level restrictions to limit access to the /api/admin/sys-user/reset/password/ endpoint to trusted IP addresses only
• Deploy a reverse proxy or WAF rule to block unauthorized password reset requests pending the upgrade
• Disable the password reset functionality entirely if not critical to operations until the patch can be applied
• Implement additional authentication checks at the application gateway level

# Example: Restrict access to password reset endpoint via nginx
location /api/admin/sys-user/reset/password/ {
    # Allow only from trusted admin network
    allow 10.0.0.0/8;
    deny all;
    
    # Forward to application
    proxy_pass http://backend;
}