Bank Management Springboot CVE-2026-11521

The CVSS vector PR:L confirms that a low-privilege authenticated account on the target application is required - unauthenticated exploitation is not supported by available data. The vulnerability is triggered by interacting with the Transaction Endpoint in TransactionController.java; no non-default configuration is indicated as a prerequisite, suggesting the endpoint is exposed in the application's standard deployment. Limiting factors include: possession of at least one valid low-privilege account on the target instance, and network reachability to the application's HTTP interface. There is no evidence of a specific feature flag or deployment mode required to expose the flaw. The RC:R CVSS temporal modifier indicates the vulnerability report has not been fully independently corroborated across all sources beyond VulDB.

The CVSS 3.1 base score of 6.3 (Medium) reflects network reachability (AV:N), low attack complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), and partial impacts across confidentiality, integrity, and availability (C:L/I:L/A:L/S:U). The CVSS temporal modifier E:P confirms proof-of-concept exploit code exists, elevating practical exploitability above the base score alone. The RC:R modifier indicates reasonable but not fully corroborated confidence. The RL:X modifier confirms no official remediation level has been defined, consistent with the maintainer's non-response. No EPSS score was included in this intelligence package, so a numerical exploitation probability cannot be assessed. The project is not listed in CISA KEV, meaning confirmed active exploitation in production environments is not established at time of analysis. Despite the moderate CVSS score, the real-world risk is elevated: this is a banking application handling sensitive financial data, a public PoC is available, the attack requires only a low-privilege account with no complexity barrier, and no patch exists. The combination of unpatched status, public PoC, and financial data sensitivity makes this a higher priority than the raw CVSS score implies.

An attacker registers or obtains a low-privileged customer account on the target application, then sends a crafted HTTP request to the Transaction Endpoint substituting another user's transaction or account identifier in the request parameters - the server processes the request without validating that the authenticated user owns the referenced resource. A publicly available proof-of-concept documented in GitHub issue #8 demonstrates this technique, lowering the technical bar significantly. Because attack complexity is low and no user interaction is required, a competent attacker can reliably enumerate and access or modify other customers' transaction records with minimal effort.