Springblade
CVE-2025-70982
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.9. Enterprise application framework vulnerability. |
| Exploit ScenarioDerived | Low-privileged user uses import function to create admin accounts or modify existing user privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user data and escalate privileges. PoC available.
Earlier versions of this analysis (1)
Privilege escalation via user import in SpringBlade.
RemediationAI
Update SpringBlade. Restrict import functionality to administrators.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-284 in SpringBlade's importUser function. Low-privileged users can import users with elevated roles.
Know when Springblade gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.
Executive ViewAI
CVE-2025-70982 is a critical access control flaw in SpringBlade v4.5.0 that enables low-privileged users to illegally import sensitive user data, creating immediate risk of data breach and compliance violations. Any organization running this software version is at high risk of unauthorized data exfiltration and must take urgent action. This vulnerability has a public exploit available, significantly increasing likelihood of active exploitation.
Disable the importUser function entirely if not operationally critical; implement strict network segmentation restricting access to SpringBlade to authorized networks only; deploy WAF rules to monitor and block suspicious importUser API calls; enforce MFA and restrict low-privilege account capabilities; implement real-time alerting on importUser function execution; enable comprehensive audit logging of all import activities with SIEM integration; restrict database access permissions to minimum required levels.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Springblade
View allSpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment.
The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. Rated critical sever
Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens us
An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api
An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions c
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks,
A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Rated medium severity (CVSS 5.3)
SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway res
Authorization bypass in SpringBlade through 5.0.2 lets attackers read other users' account information by supplying an a
Improper authorization in SpringBlade up to 5.0.1 allows an authenticated remote user to access role or user detail reco
Improper authorization in the SpringBlade Java microservice framework (all versions up to 5.0.1) lets an authenticated u
Exploit-DB