CVE-2026-97368: SpringBlade Authorization Bypass Vulnerability

CVE-2026-97368 is an authorization bypass flaw in chillzhuang SpringBlade up to version 5.0.2 affecting the UserServiceImpl component. Attackers can remotely exploit this weakness to gain unauthorized access. This post explains technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-97368 Overview

CVE-2026-97368 is an authorization bypass vulnerability in chillzhuang SpringBlade through version 5.0.2. The flaw resides in the UserServiceImpl.userInfo function within blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java, exposed through the user-auth-info endpoint. Manipulating the userId argument lets a remote attacker retrieve user account information belonging to other accounts without proper authorization checks [CWE-285].

Critical Impact
A remote attacker can enumerate and access user account information by tampering with the userId parameter sent to the user-auth-info endpoint, bypassing the application's authorization logic.

Affected Products

chillzhuang SpringBlade versions up to and including 5.0.2
SpringBlade blade-system service module
SpringBlade user-auth-info endpoint implementation

Discovery Timeline

2026-09-24 - CVE-2026-97368 published to the National Vulnerability Database
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-97368

Vulnerability Analysis

The vulnerability affects SpringBlade, an open-source microservice development platform built on Spring Boot. The UserServiceImpl.userInfo method, invoked through the user-auth-info HTTP endpoint, accepts a userId parameter from the request and returns the corresponding user account data. The method does not verify that the authenticated caller is authorized to view the requested userId.

An attacker who can reach the endpoint can supply arbitrary numeric identifiers and iterate through them to harvest account records. According to the vendor advisory references, a public proof-of-concept exists, and the vendor did not respond to coordinated disclosure attempts. The issue is distinct from CVE-2026-56100 and CVE-2026-36765.

Root Cause

The root cause is a missing authorization check [CWE-285] on the userId request parameter inside UserServiceImpl.userInfo. The service layer trusts the client-supplied identifier and queries the underlying user store directly, without comparing the requested userId against the identity bound to the current session or token. This is a classic Insecure Direct Object Reference pattern on an identity resource.

Attack Vector

Exploitation is performed remotely over the network against the user-auth-info endpoint. The attacker issues HTTP requests to the endpoint while varying the userId query parameter. Each response returns the targeted user's profile fields, enabling bulk enumeration of account data across tenants or administrative users. User interaction is not required beyond the attacker's own request issuance. No synthetic exploit code is published here; see the referenced GitHub CVE Request Documentation for the public proof-of-concept.

Detection Methods for CVE-2026-97368

Indicators of Compromise

Repeated HTTP requests to the user-auth-info endpoint with sequential or varying userId values from a single source address.
Access patterns where one authenticated session retrieves user profiles for multiple distinct userId values in a short time window.
Application logs showing successful responses from UserServiceImpl.userInfo for identifiers unrelated to the caller's own account.

Detection Strategies

Instrument the user-auth-info endpoint to log the authenticated principal alongside the requested userId and alert on mismatches.
Deploy a web application firewall rule that flags enumeration behavior against identity-related endpoints based on request rate and parameter cardinality.
Review historical access logs for the /user-auth-info path and identify sessions that queried an unusually high number of unique userId values.

Monitoring Recommendations

Baseline normal user-auth-info request volume per user and alert on deviations.
Capture the full request URI and response size to detect bulk data retrieval through the endpoint.
Forward SpringBlade application logs to a centralized analytics platform to correlate authorization anomalies across services.

How to Mitigate CVE-2026-97368

Immediate Actions Required

Restrict network access to the user-auth-info endpoint using an upstream reverse proxy or API gateway until a code-level fix is in place.
Add a server-side authorization check in UserServiceImpl.userInfo that compares the requested userId to the authenticated principal before returning data.
Audit application logs for prior exploitation of the endpoint and rotate credentials of any accounts whose data may have been exposed.

Patch Information

As of publication, the vendor has not released an official patch and did not respond to disclosure attempts. Operators should apply the authorization check manually in blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java and track the upstream SpringBlade repository for an official fix. Monitor the VulDB CVE-2026-97368 Details advisory for updates.

Workarounds

Enforce role-based access control at the API gateway so that only administrative identities may call user-auth-info with a userId other than their own.
Introduce an authorization interceptor in the Spring filter chain that validates the caller's privileges against the requested resource identifier.
Rate-limit the user-auth-info endpoint to slow enumeration and generate alerts when thresholds are exceeded.

bash

# Example nginx reverse-proxy restriction limiting the endpoint
# to a trusted internal management subnet
location /user-auth-info {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://springblade-upstream;
}