What is the CVSS score of CVE-2026-97060?

CVE-2026-97060 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-97060?

Yes, a public proof-of-concept exploit is available for CVE-2026-97060. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-97060?

Within 24 hours, inventory all X-SpringBoot instances at version 6.0 or earlier, confirm which accounts hold delegated user-management permissions, and immediately revoke or suspend those delegated roles wherever operationally feasible; simultaneously block or rate-limit POST /sys/user/update and POST /sys/user/delete at the WAF or reverse proxy for all non-super-administrator sessions, and enable verbose audit logging on both endpoints to capture actor identity, target user, and source IP. Within 7 days, review authentication logs for anomalous password resets, role rebinds, or user deletions performed by delegated accounts since the vulnerability became public, force credential rotation and session invalidation for all accounts with user-management scope, enforce MFA on those accounts, and engage the X-SpringBoot vendor to obtain a remediation timeline or hotfix. Within 30 days, upgrade to the first vendor release that addresses CVE-2026-97060 once published (current installations should be considered vulnerable through version 6.0), and if the vendor remains silent, implement a permanent compensating control - either a custom authorization layer enforcing object-level ownership checks on the affected endpoints or removal of delegated user-management functionality altogether - with a re-assessment of residual risk and a documented exception accepted by the CISO.

X-SpringBoot CVE-2026-97060

EUVD-2026-87254 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-25 VulnCheck

Java X Springboot

8.6

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain sub-admin account with user-management rights
Delivery

Enumerate/target super-admin user ID
Exploit

POST /sys/user/update to reset password
Execution

Authenticate as super administrator
Impact

Full system takeover or delete users

Vulnerability Assessment

Weakness	CWE CWE-639 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Object-level authorization, IDOR prevention
Exploitation Conditions	The attacker must already hold a valid X-SpringBoot account with user-management permissions (a 'sub-administrator'), so this is authenticated horizontal/vertical escalation, not remote-unauthenticated compromise. The vulnerable endpoints POST /sys/user/update and POST /sys/user/delete perform no object-level ownership verification, letting any user-management-capable account act on ANY user record including the super administrator. Limiting factors: requires the delegated user-management role (PR:H), affects X-SpringBoot versions 0 through 6.0, and impact is bounded to instances that actually provision sub-administrator accounts rather than a single all-powerful admin.
Impact	This is a genuine, actionable priority rather than an inflated high-CVSS score, but its severity is tempered by the privilege requirement. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, 8.6) shows a network-reachable, low-complexity flaw with high confidentiality/integrity/availability impact but requiring high privileges (PR:H) - consistent with the description's requirement that the attacker already hold user-management (sub-administrator) permissions. This is a broken-object-level-authorization (IDOR/BOLA) flaw, CWE-639, not a pre-auth issue. A publicly available POC (VulnCheck advisory plus a GitHub exploit script) elevates real risk: exploitation is trivial once a low-tier admin account is obtained, and resetting the super-administrator password yields full instance takeover - a classic horizontal-to-vertical privilege escalation. No CISA KEV listing and no EPSS score are provided, so there is no evidence of widespread active exploitation; the primary mitigating factor is prevalence, since X-SpringBoot is a niche open-source rapid-development scaffold, not enterprise-ubiquitous software. Net: high technical impact and a working exploit, but gated behind an existing privileged account and limited real-world footprint.
Exploit ScenarioDerived	An organization uses X-SpringBoot and delegates a limited 'sub-administrator' account with user-management rights to a junior operator or a compromised third party. That user sends POST /sys/user/update against the super administrator's user ID to reset its password (or rebind roles), then logs in as super admin - achieving full control. A public POC (LinYuanyi1/cve-request-poc x-springboot cross-object BOLA script) demonstrates this exact flow.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

1 public PoC No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Authenticated privilege escalation in X-SpringBoot through 6.0 lets any account with delegated user-management permissions reset passwords, rebind roles, or delete users - including the super administrator - through POST /sys/user/update and POST /sys/user/delete because those endpoints perform no object-level ownership verification. Publicly available exploit code exists, in the form of the referenced Python BOLA proof-of-concept, but no CISA KEV status is provided and the risk is tempered by the PR:H requirement that the attacker already be a sub-administrator rather than an unauthenticated remote user. The impact is full compromise of user accounts on affected instances that delegate user-management privileges.

RemediationAI

No vendor-released patch identified at time of analysis; the GitHub reference is to vulnerable source code rather than a tagged fix, so no exact upgrade version can be cited and current releases should not be assumed fixed. Until the vendor publishes a patched release, restrict user-management privileges to the smallest possible set of trusted administrators, remove delegated sub-administrator roles where they are not required, and review for any accounts that hold user-management permissions; this reduces exposure but can disrupt delegated administration. If you can modify source, add server-side object-level authorization around SysUserController lines 190-216 so POST /sys/user/update and POST /sys/user/delete verify that the caller may act on the specific target user and cannot modify or delete the super administrator or out-of-scope accounts; treat this as an interim code fix, not a vendor-supported patch. Consider blocking, IP allowlisting, or requiring re-authentication/MFA at a reverse proxy or WAF for those two endpoints, with the trade-offs that blocking breaks legitimate user administration and allowlisting does not stop a compromised admin workstation. Enable alerting and audit review for password resets, role rebinds, and deletions through those endpoints, especially against super administrator accounts, and rotate credentials and sessions if abuse is suspected. Monitor https://github.com/yzcheng90/X-SpringBoot and https://www.vulncheck.com/advisories/x-springboot-through-6.0-authorization-bypass-via-user-management for a fixed release, and note that public exploit code exists at https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/03_user-admin-cross-object-bola.py.

Affected VersionsENISA

X-SpringBoot 0 ≤6.0

Affected Packages

euvd x_springboot no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

X-SpringBoot is a Spring Boot-based Java administration framework identified by CPE cpe:2.3:a:yzcheng90:x-springboot:*:*:*:*:*:*:*:*. The underlying flaw is CWE-639 Authorization Bypass Through User-Controlled Key, a broken object-level authorization (BOLA/IDOR) class in which the server trusts a user-supplied record identifier without verifying that the requesting principal is allowed to act on that record. The vulnerable controller is referenced at SysUserController.java lines 190-216, and the two affected endpoints are POST /sys/user/update and POST /sys/user/delete. The provided CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N with a score of 8.6, and the independent assessment maps the same impact to CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, confirming high confidentiality, integrity, and availability impact but a high privilege prerequisite. Because the vector includes PR:H and the assessment states the attacker must already have user-management permissions, this is authenticated horizontal/vertical escalation, not remote-unauthenticated compromise; it matters most where sub-administrator accounts are provisioned.

Know when X Springboot gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.2 HIGH

Network endpoint, low complexity, but requires an existing user-management (sub-admin) account so PR:H; super-admin takeover yields full C/I/A impact within the same system (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

High

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.

Technical POC Analysis

Evidence note: the supplied artifact is the PoC script 03user-admin-cross-object-bola.py, not a patched source file despite the file banner.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Latest POC

1 public PoC link from github

Executive ViewAI

Why It Matters

X-SpringBoot deployments through version 6.0 contain a privilege-escalation flaw in the user-management API that allows sub-administrators to take over, re-role, or delete any account on the platform - including the super administrator. Any organization that delegates user-management duties to helpdesk, HR, or regional administrators is exposed, and successful abuse converts routine delegated access into full administrative control of the application and its data. Because no vendor patch is currently available and exploit code is public, leadership should treat this as an active exposure requiring containment rather than routine patch scheduling.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: revoke or tightly limit delegated user-management privileges so no sub-administrator can reach POST /sys/user/update or POST /sys/user/delete; block or restrict those two endpoints at the WAF/reverse proxy for non-super-administrator roles; enforce MFA and short session lifetimes on any account retaining user-management scope; enable and monitor detailed audit logging with alerting on password resets, role changes, and account deletions; isolate affected X-SpringBoot instances on segmented networks with restricted administrative access; and rotate credentials plus invalidate sessions after any suspected abuse.

Threat Intelligence Overview

EPSS Score

0.3%

Top 78% exploitable

Prevalence

Low

niche open-source Chinese Spring Boot scaffold, no enterprise footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.