CVE-2026-105610: chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization
A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument initPassword results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and has low attack complexity, but it requires high privileges. No user interaction is required.
Which deployments are affected?
SpringBlade versions up to and including 5.0.1 are identified as affected. The issue is in Parameter Submit Management, in ParamController.java, and involves manipulation of the initPassword argument.
Is public exploit information available?
Yes. An exploit has been made public and could be used.
Has a fix been confirmed?
No fix is identified in the available information. The project was notified through an issue report but had not responded at the time of publication.