CVE-2026-97060

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0

Description The software lacks object-level authorization in user management endpoints, which allows sub-administrators to modify or delete users without ownership verification. Attackers possessing user-management permissions can reset passwords for any account, including the super administrator, rebind roles, or delete users. This is possible through the 'POST /sys/user/update' and 'POST /sys/user/delete' endpoints.

Recommendations Update X-SpringBoot to a version later than 6.0. Restrict access to the 'POST /sys/user/update' and 'POST /sys/user/delete' endpoints to minimize the risk of exploitation.