CVE Watch6 oct 2026

CVE-2026-105611

A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-syst

CVSS

2.7

Bajo

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 6 oct 2026 · Última mod.: 6 oct 2026 · CWE-266 · CWE-285

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-955948.1 ALT

—

———Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.0 versions.5h CVE-2026-481977.2 ALT

—

———Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.5h CVE-2026-397758.8 ALT

—

———Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.5h CVE-2026-397748.8 ALT

—

———Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.5h CVE-2026-3977310.0 CRÍ

—

———Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.5h CVE-2026-397657.2 ALT

—

———Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.5h