EUVD-2026-87202
GHSA-6ffj-pvxh-v3c2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed StarTraining instance
-
ExploitRequest unauthenticated /api-docs endpoint
-
ExecutionReceive Swagger/OpenAPI spec without auth
-
ImpactHarvest API routes and parameters for follow-on attacks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the StarTraining application (up to 3.8.1) expose its Swagger/OpenAPI api-docs endpoint - governed by SecurityConfig.java - over the network without an authentication filter, which per the advisory is the default/misconfigured state described. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and the attack is remote (AV:N). The practical limiting factor is exposure: the instance's api-docs route must be network-reachable to the attacker, and impact is confined to disclosure of API documentation/structure (VC:L) rather than data modification or service disruption. |
| Impact | The signals converge on a low-to-moderate, information-disclosure-only issue rather than a top priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N, score 5.5) describes a remotely reachable, unauthenticated, low-complexity flaw whose only impact is limited confidentiality (VC:L), with no integrity or availability effect and no scope change - consistent with an unprotected Swagger/OpenAPI (api-docs) endpoint leaking API structure. The vector carries E:P (Proof-of-Concept), matching the reported public exploit; there is no CISA KEV entry and no EPSS score provided, so exploitation is opportunistic/plausible but not demonstrated at scale. The single intelligence source is VulDB (with a linked third-party GitHub advisory), and the vendor did not respond, so affected-version and fix data are unverified. Net: publicly available exploit code exists for a trivially triggerable but bounded disclosure - real enough to fix, but the limited (VC:L only) impact and obscure product keep it well below active-exploitation-grade priority. |
| Exploit ScenarioDerived | An unauthenticated remote attacker requests the exposed api-docs (Swagger/OpenAPI) endpoint of a StarTraining instance and receives the full API specification without any authentication, enumerating routes, parameters, and internal service structure to plan further attacks. A public exploit/advisory (ArrestX ST-VULN-003) already documents the exact request, so no development effort is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated access to the Swagger/OpenAPI api-docs endpoint in zhistaredu StarTraining through 3.8.1 allows remote attackers to retrieve API documentation and structural details when the endpoint is network-reachable and SecurityConfig.java lacks an authentication filter. Public exploit code exists, but this is an information-disclosure issue (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), not confirmed active exploitation; the vendor did not respond to the disclosure. The practical risk depends on exposing the api-docs route, and impact is limited to confidentiality of API structure.
RemediationAI
No vendor-released patch identified at time of analysis; the vendor did not respond to the disclosure, so remediation must be applied locally. Immediate compensating controls include restricting network access to the api-docs route (for example, block /v3/api-docs, /swagger-ui, /swagger-resources, and any configured springdoc or springfox paths at the reverse proxy or firewall), which prevents remote unauthenticated disclosure but may break legitimate documentation access for developers. Alternatively, update SecurityConfig.java to require authentication for the api-docs endpoint and related Swagger UI paths, accepting the operational overhead of credential management for documentation consumers. Disabling Swagger/OpenAPI generation in production (for example, via springdoc.api-docs.enabled=false or equivalent configuration) removes the exposure but sacrifices runtime API documentation. Given that public exploit code exists and the issue is information disclosure only, prioritize these controls based on whether the StarTraining instance is internet-facing. Monitor the referenced GitHub advisory and VulDB entry for a vendor fix, and treat exposed api-docs endpoints as an information leak that may aid further attacks. See https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-003-swagger-api-docs-unauth.md for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-306 (Missing Authentication for Critical Function) within a Spring Boot/Java application. The component api-docs endpoint is the Swagger/OpenAPI documentation route, typically served by springdoc or springfox and controlled by Spring Security in SecurityConfig.java. When the security configuration does not apply an authentication filter to that path, the documentation and underlying API metadata are reachable without credentials. CPE cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*:* confirms the affected product is zhistaredu StarTraining across versions up to 3.8.1. Tags Java, Authentication Bypass, and Startraining align with a Java web application and missing authorization check on documentation endpoints. The attack is remote (AV:N) and unauthenticated (PR:N), and no user interaction is required (UI:N); because only documentation is exposed, the assessed impact is limited to low confidentiality loss (C:L) with no integrity or availability effect.
Know when Startraining gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Remote, unauthenticated, low-complexity access to an unprotected api-docs endpoint yields only limited confidentiality (API spec exposure); no integrity or availability impact and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Startraining
View allUnauthenticated remote access to the Alibaba Druid monitoring console bundled with zhistaredu StarTraining 3.8.1 and ear
StarTraining 3.8.1 and earlier embeds a hard-coded JWT signing secret in application.yml, allowing an unauthenticated re
Missing authorization in zhistaredu StarTraining up to and including version 3.8.1 lets any authenticated low-privilege
Authorization bypass in zhistaredu StarTraining through 3.8.1 allows an authenticated low-privileged user to escalate pr
Cross-site scripting in zhistaredu StarTraining up to and including 3.8.1 becomes exploitable when the built-in XSS filt
Exploit-DB