SpringBlade EUVD-2026-86467

Exploitation requires reaching the SpringBlade user-auth-info endpoint served by UserServiceImpl.userInfo (blade-service/blade-system) and supplying an attacker-chosen userId value belonging to another user; the missing object-level authorization check then returns that user's information. Affected versions are SpringBlade up to and including 5.0.2. Limiting factors: impact is read-only disclosure of user information (no modification or code execution); despite VulDB's PR:N, the endpoint is a user/auth-info API that in practice typically requires a valid authenticated session to invoke, so realistic exploitation likely needs low-privileged authentication - verify against the public PoC. No official patch is available because the vendor did not respond.

This is a moderate, low-priority issue in real terms despite being remotely reachable. The sole scoring source is VulDB (CVSS 4.0 base 5.3, AV:N/AC:L/PR:N/UI:P/VC:L/VI:L/VA:L, E:P), which is a low-signal, template-heavy assessor; the impact spread (all three of VC/VI/VA set to Low) is characteristic of VulDB's conservative default rather than an evidenced integrity/availability effect - CWE-639 (IDOR / authorization bypass) on a userInfo read endpoint is fundamentally a confidentiality issue, so VI:L/VA:L are likely inflated and I:N/A:N are more defensible. Public exploit code exists (POC=YES, hosted at aibot88.github.io), which raises practical exploitability, but there is NO EPSS score and NO CISA KEV listing, so there is no evidence of automated or active exploitation - POC availability and active exploitation are distinct signals and only the former is present here. Note a conflict worth verifying: VulDB rates PR:N (unauthenticated) yet an IDOR against a user-auth-info endpoint typically requires a valid session to reach the endpoint and merely lets the attacker read OTHER users' records - verify the auth requirement with the exploit/source before treating this as fully unauthenticated. UI:P is also questionable, as IDOR exploitation is a direct request and rarely needs user interaction. Net: real but low-to-moderate risk, aggravated by public PoC and an unresponsive vendor (no patch), mitigated by read-only impact and no confirmed exploitation.

An attacker sends a crafted request to the SpringBlade user-auth-info endpoint backed by UserServiceImpl.userInfo, substituting a different userId value than their own to retrieve another user's profile/account information without authorization. Public exploit code is available (referenced on aibot88.github.io), lowering the skill barrier; because the attack vector is network with low complexity, iterating userId values enables enumeration of user records. Impact is read-only disclosure of user information rather than modification or takeover.