CVE-2026-79571: Spring SellerAuthorizeAspect (Spring Boot project) vulnerability
Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker who can reach the affected application's seller management interfaces can exploit it. No seller account or other authentication is required.
What actions can an attacker perform through the exposed interfaces?
An attacker can access all seller management interfaces, list products and orders, put products on or off sale, finish or cancel orders, and modify categories.
How can I tell whether my deployment is affected?
A deployment is affected if it uses springboot-project v1.0.0 and unauthenticated requests can reach seller management interfaces protected by the SellerAuthorizeAspect component.