CVE-2026-97060— X-SpringBoot through 6.0 Authorization Bypass via User Management
Quick assessment
Affected
yzcheng90 X-SpringBoot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 X-SpringBoot 6.0 及之前版本中，用户管理接口缺乏对象级别的授权控制，导致子管理员可以在未验证资源归属权的情况下修改或删除其他用户账户。拥有用户管理权限的攻击者可以通过 POST /sys/user/update 和 POST /sys/user/delete 接口重置任意账户（包括超级管理员）的密码、重新绑定角色或删除用户。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97060
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
X-SpringBoot through 6.0 Authorization Bypass via User Management
Source: CVE Program / CVE List V5
Vulnerability Description
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| yzcheng90 | X-SpringBoot | 0 ~ 6.0 | - |
|
II. Public POCs for CVE-2026-97060
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97060
请登录查看更多情报信息。
Proof of Concept for CVE-2026-97060 (1)
Other References for CVE-2026-97060 (1)
Other References for CVE-2026-97060 (1)
Same Patch Batch · yzcheng90 · 2026-09-25 · 4 CVEs total
| CVE-2026-97063 | 9.1 CRITICAL | X-SpringBoot through 6.0 Authentication Bypass via Login Code |
| CVE-2026-97064 | 9.1 CRITICAL | X-SpringBoot through 6.0 Authentication Bypass via Static Master Code |
| CVE-2026-100192 | 6.5 MEDIUM | X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint |
IV. Related Vulnerabilities
Same product: X-SpringBoot
-
CVE-2026-97064
X-SpringBoot through 6.0 Authentication Bypass via Static Ma -
CVE-2026-97063
X-SpringBoot through 6.0 Authentication Bypass via Login Cod -
CVE-2026-100192
X-SpringBoot through 6.0 Credential Exposure via Unauthentic -
CVE-2025-6731
yzcheng90 X-SpringBoot APK File apk uploadApk path traversal
Same vendor: yzcheng90
-
CVE-2026-97064
X-SpringBoot through 6.0 Authentication Bypass via Static Ma -
CVE-2026-97063
X-SpringBoot through 6.0 Authentication Bypass via Login Cod -
CVE-2026-100192
X-SpringBoot through 6.0 Credential Exposure via Unauthentic -
CVE-2025-6731
yzcheng90 X-SpringBoot APK File apk uploadApk path traversal
Same weakness: CWE-639
-
CVE-2026-82323
Improper Authorization in Enocta Educational's Enocta Platfo -
CVE-2026-82348
Apache Roller: Cross-weblog resource tampering via unscoped -
CVE-2026-100897
fuzui StudentInfo Password Change Endpoint moditypasswordstu -
CVE-2026-100885
Krayin laravel-crm admin-config-setup API Endpoint CanInstal -
CVE-2026-101084
obot before v0.21.1 Authorization Bypass via /mcp-connect
V. Comments for CVE-2026-97060
No comments yet