SpringBlade CVE-2026-105611

Exploitation requires an authenticated session against the SpringBlade User Detail endpoint (RoleController.java); the attacker then alters the ID request parameter to access records they do not own. Limiting factors: it is not unauthenticated (the CVSS vector specifies PR, so some valid account is needed), and impact is confined to confidentiality of user/role detail data - there is no integrity or availability effect and no code execution. The practical privilege level needed is likely lower than the vendor's PR:H rating because IDOR flaws are usually abusable by any logged-in user, which would make exploitation easier than the base score implies.

This is a moderate, not urgent, priority. The only quantitative severity signal provided is a vendor (VulDB) CVSS 4.0 base score of 5.1 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N (E:P indicating a proof-of-concept exploit maturity). The vector tells a consistent story: network-reachable, low attack complexity, but requiring privileges and yielding only LOW confidentiality impact with no integrity or availability impact - i.e. information disclosure of user detail data via improper authorization (IDOR-style ID manipulation), not system compromise. There is NO CISA KEV listing and NO EPSS score in the provided data, so widespread or automated exploitation cannot be inferred; the only exploitation signal is a publicly disclosed POC referenced in the vendor's GitHub issue, which is distinct from active exploitation. A notable caveat: the vendor rates PR:H, but an improper-authorization/IDOR flaw on a user-detail endpoint is typically exploitable by any authenticated (low-privilege) user manipulating the ID parameter, so the real privilege barrier may be lower than PR:H suggests - verify the actual authentication tier required. Also note the project 'has not responded yet,' so no patch is confirmed available, which raises residual risk for deployments despite the modest impact score.

An attacker who holds a valid (likely low-privilege) account on a SpringBlade deployment sends a request to the User Detail endpoint in RoleController.java and manipulates the ID argument to reference records belonging to other users or roles. Because authorization is improperly enforced, the server returns data the attacker is not entitled to, leaking user/role details. A public proof-of-concept exists (referenced in the vendor and GitHub issue links), lowering the effort to reproduce.