CVE-2026-93961: Dromara UJCMS Authentication Bypass Flaw

CVE-2026-93961 Overview

CVE-2026-93961 is an improper authorization vulnerability [CWE-266] in Dromara UJCMS versions up to 12.3.1. The flaw resides in the usernameExist function within ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java. An attacker can manipulate the Username argument to trigger the improper authorization condition. The attack is executable remotely without authentication or user interaction. The project maintainers were notified through an issue report but have not responded at the time of disclosure.

Critical Impact

Unauthenticated remote attackers can enumerate valid usernames through the exposed usernameExist endpoint, enabling reconnaissance for follow-on credential attacks against UJCMS deployments.

Affected Products

• Dromara UJCMS versions up to and including 12.3.1
• The UserController component in ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java
• Deployments exposing the UJCMS API surface to untrusted networks

Discovery Timeline

• 2026-09-20 - CVE-2026-93961 published to the National Vulnerability Database (NVD)
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-93961

Vulnerability Analysis

The vulnerability affects the usernameExist function inside UserController.java, part of the UJCMS content management system. The endpoint accepts a Username argument and returns information about whether that user exists in the system. Because the function does not enforce appropriate authorization, any remote client can invoke it. This exposes account existence data that should be restricted to authenticated administrative contexts.

The underlying weakness maps to [CWE-266] Incorrect Privilege Assignment. Functionality intended for privileged workflows is reachable by unprivileged callers. Attackers can iterate through candidate usernames to build a valid account list. That list feeds password spraying, phishing, and targeted brute-force campaigns against the CMS.

Root Cause

The root cause is missing or insufficient access control checks on the usernameExist handler in UserController. The function performs a lookup based on the caller-supplied Username parameter and returns the result without validating whether the caller holds the required role or session context.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests to the usernameExist endpoint with varying Username values. Responses indicate whether each supplied username exists in the UJCMS user store, enabling automated enumeration at scale.

No verified public exploit code is available. Refer to the GitHub Issue #22 on UJCMS and the VulDB CVE-2026-93961 entry for technical details.

Detection Methods for CVE-2026-93961

Indicators of Compromise

• Repeated unauthenticated HTTP requests targeting the usernameExist API endpoint from a single source or distributed sources
• High-volume enumeration traffic with sequentially varying Username parameter values
• Increased authentication failures on UJCMS login endpoints following enumeration activity

Detection Strategies

• Instrument web application logs to capture requests reaching UserController.usernameExist and alert on request rates that exceed baseline
• Deploy web application firewall (WAF) rules that require an authenticated session cookie or token before allowing access to user-existence endpoints
• Correlate username-existence API traffic with subsequent login attempts to identify enumeration-to-brute-force pivots

Monitoring Recommendations

• Baseline normal API traffic patterns for the UJCMS /api/ surface and alert on statistical anomalies
• Retain HTTP access logs with source IP, request path, and query parameters for at least 90 days to support investigation
• Monitor for outbound reconnaissance patterns and IP reputation changes across sources querying UJCMS endpoints

How to Mitigate CVE-2026-93961

Immediate Actions Required

• Restrict network access to the UJCMS administrative and API surfaces using firewall rules or reverse proxy access controls
• Place UJCMS instances behind an authenticated gateway or VPN until an upstream patch is available
• Audit UJCMS user accounts for weak passwords and enforce multi-factor authentication where supported

Patch Information

No vendor patch is currently available. According to the disclosure, the Dromara project was notified through GitHub Issue #22 on UJCMS but has not responded. Monitor the GitHub Repository for UJCMS for future security releases beyond version 12.3.1.

Workarounds

• Block or rate-limit unauthenticated requests to the usernameExist endpoint at a reverse proxy such as Nginx or an API gateway
• Apply a WAF rule that denies requests to user-existence API paths unless a valid session cookie is present
• Deploy a custom Spring interceptor or filter to enforce role-based authorization on the UserController.usernameExist handler

# Example Nginx configuration to require authentication cookie for the vulnerable endpoint
location ~* /api/.*usernameExist {
    if ($cookie_JSESSIONID = "") {
        return 401;
    }
    limit_req zone=ujcms_api burst=5 nodelay;
    proxy_pass http://ujcms_backend;
}