Is there a public PoC exploit available for CVE-2026-11521?

Yes, a public proof-of-concept exploit is available for CVE-2026-11521. Prioritise patching immediately. EPSS: 0.0%.

Bank Management Springboot CVE-2026-11521

Q: What is the CVSS score of CVE-2026-11521?

CVE-2026-11521 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35075 LOW

Improper Authorization (CWE-285)

2026-06-08 VulDB

GHSA-4vv9-c3hj-rh83

Authentication Bypass Java Bank Management System Springboot

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 15:37 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 15:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 08, 2026 - 14:52 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controller/TransactionController.java of the component Transaction Endpoint. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper authorization in Mohammed-eid35's bank-management-system-springboot exposes the Transaction Endpoint to low-privileged authenticated remote attackers, enabling unauthorized access to or manipulation of financial transaction records belonging to other users. All versions up to commit 7b9bcc65ad7df3db29af71aed9bb500e5f24d948 are affected, with publicly available exploit code disclosed via GitHub issue #8. No patch has been released - the maintainer has not responded to the responsible disclosure report - making this an unresolved risk for any organization running this application.

Technical ContextAI

The affected component is TransactionController.java located at src/main/java/com/alien/bank/management/system/controller/TransactionController.java, a Spring Boot REST controller within the com.alien.bank.management.system.controller package responsible for handling banking transaction operations. The root cause is CWE-285 (Improper Authorization), meaning the application processes transaction requests without adequately verifying that the requesting principal is authorized to act on the targeted resource - a classic broken object-level authorization (BOLA/IDOR) pattern common in Spring Boot REST APIs that rely on caller-supplied identifiers without server-side ownership validation. The CPE cpe:2.3:a:mohammed-eid35:bank-management-system-springboot:*:*:*:*:*:*:*:* confirms the scope as all released states of this open-source Java Spring Boot banking application hosted on GitHub, with no version boundary on the upper end beyond the identified commit hash.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the responsible disclosure submitted via GitHub issue, and RL:X in the CVSS temporal vector confirms no remediation level is defined. Organizations running this application should immediately restrict network access to the Transaction Endpoint via firewall rules or API gateway authorization policies, accepting that this will disable transaction functionality until a code fix is applied. As a deeper compensating control, introduce server-side ownership validation in TransactionController.java to verify that the authenticated principal's identity matches the owner of the requested transaction resource before processing any read or write operation; this requires direct code modification. Deployment of this application in any production or sensitive environment should be suspended until the authorization logic is corrected. Security teams should monitor https://github.com/Mohammed-eid35/bank-management-system-springboot/ for commits that address authorization enforcement in TransactionController.java, as no advisory or patch release channel exists beyond the repository itself.