SpringBlade CVE-2026-105610

Exploitation requires an authenticated session with high privileges (CVSS PR:H) against the SpringBlade Parameter Submit Management feature, specifically the ParamController endpoint that handles the initPassword argument. The flaw is an improper-authorization check (CWE-285) on that parameter, so the limiting factor is that an attacker must already possess elevated access to the SpringBlade backend; no unauthenticated or low-privilege path is indicated. No user interaction is required (UI:N), and no non-default configuration is specified in the available data, but impact is constrained to LOW across confidentiality, integrity, and availability.

This is a low-priority issue despite being remotely reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) scores only 2.0, driven primarily by PR:H - the attacker must already hold high privileges in the SpringBlade system before touching the vulnerable initPassword parameter - and by uniformly LOW impact (VC:L/VI:L/VA:L) with no scope change. Exploitation signals are mixed but weak: publicly available exploit code exists (POC=YES) and the CVSS includes E:P (proof-of-concept exploit maturity), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. The single intelligence source is VulDB, and the 'exploit' reference is simply a GitHub issue report (#41) that the project has not yet acknowledged - this is a reporter-disclosed issue rather than confirmed weaponization. Net: a genuine authorization flaw (CWE-285) but a low-real-risk one, gated behind existing privileged access and causing only limited impact. The 'Authentication Bypass' tag overstates the issue - the underlying weakness is improper authorization requiring an already-authenticated high-privilege actor, not an authentication bypass; verify with the issue report before treating it as a pre-auth bypass.

An authenticated user holding high privileges in a SpringBlade deployment sends a crafted request to the Parameter Submit Management endpoint (ParamController) and manipulates the initPassword argument, which is not properly authorization-checked, to alter the system's initial-password configuration. A proof-of-concept is publicly available via the project's GitHub issue tracker, but exploitation yields only limited confidentiality, integrity, and availability impact and requires pre-existing privileged access.