EUVD-2026-72849
GHSA-62mr-8m9f-4455
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach app over network
-
DeliverySend request to /seller management endpoint
-
ExploitSellerAuthorizeAspect fails to enforce auth
-
ExecutionList/modify products and orders
-
ImpactCancel orders, alter categories
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the springboot-project v1.0.0 seller-management HTTP endpoints; per AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special configuration needed against a default deployment. The only real limiting factor is that the application (specifically its seller-side interfaces) must be network-exposed to the attacker - there is no version gating beyond running the vulnerable v1.0.0 code and no platform dependency. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) describes a trivially reachable, unauthenticated, low-complexity flaw with high confidentiality and integrity impact and no availability impact - internally consistent with the description. However, real-world priority is tempered by exposure: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no weaponized public exploit is identified - only a GitHub write-up. Most importantly, springboot-project appears to be a hobby/learning project with negligible production deployment, so the 9.1 severity reflects the flaw's mechanics rather than fleet-wide risk. The 'C:H' rating is defensible (full seller order/product data exposure) though arguably closer to moderate for a demo dataset; treat the score as accurate for the code but low as an operational priority. |
| Exploit ScenarioDerived | An attacker who can reach the application over the network sends direct HTTP requests to the seller-management endpoints without logging in, and the SellerAuthorizeAspect fails to block them. They enumerate all orders and products, then cancel legitimate orders and pull products off sale or alter category listings, disrupting the merchant. Exploitation requires only a browser or curl (AV:N/AC:L/PR:N/UI:N); no PoC tooling beyond the referenced write-up is needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Broken access control in springboot-project v1.0.0 lets remote unauthenticated attackers reach every seller-management interface through a flaw in the SellerAuthorizeAspect authorization component. Attackers can enumerate all products and orders, toggle products on/off sale, finish or cancel orders, and modify categories with no credentials. No public exploit identified at time of analysis beyond the reporter's write-up; EPSS is low at 0.18% (7th percentile).
RemediationAI
No vendor-released patch version is identified at time of analysis; the only public source is a third-party GitHub write-up, not a tagged fix. Because this is an authorization-enforcement defect, the concrete fix is to correct the SellerAuthorizeAspect so its pointcut matches all seller-management endpoints and rejects unauthenticated/unauthorized principals (return 401/403 rather than proceeding), and to add server-side authorization checks in the seller controllers themselves as defense in depth rather than relying solely on the aspect. As a compensating control until code is fixed, restrict network access to the seller-management URL paths (e.g. block or authenticate the /seller/* endpoints at a reverse proxy or gateway); the trade-off is that legitimate sellers must reach the app through that gateway. Given the project's demo nature, do not deploy v1.0.0 in production. Track updates via the vendor repository and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-79571.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
springboot-project is a small Java/Spring Boot e-commerce demo application. The affected element is the SellerAuthorizeAspect - a Spring AOP aspect intended to intercept seller-management endpoints and enforce that the caller holds a valid seller session/role before the handler executes. The root cause is CWE-284 (Improper Access Control): the aspect either fails to run on the relevant pointcuts or does not reject anonymous callers, so the seller controller methods execute for anyone. The CPE is a placeholder ('cpe:2.3:a:n/a:n/a:*'), so exact affected-package identification comes from the description and reference rather than NVD structured data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable seller endpoints with no auth or interaction (AV:N/AC:L/PR:N/UI:N); full read of orders/products (C:H) and modify/cancel actions (I:H); no availability loss (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication.
Executive ViewAI
springboot-project v1.0.0 contains a critical access control flaw that allows unauthenticated attackers to assume full control over seller-management operations, including product inventory, order processing, and catalog administration. Any organization deploying this component faces immediate risk of unauthorized order modifications, inventory tampering, and operational disruption without requiring any credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: network segmentation restricting seller-management endpoints to authorized IPs only; WAF rules blocking unauthenticated access to protected endpoints; real-time audit logging and alerting on seller-management API activity; network-based IDS/IPS signatures detecting unauthorized access patterns; operational isolation of the system until patch availability is confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB