CVE-2026-93961: Dromara UJCMS UserController UserController.java usernameExist improper authorization
A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in improper authorization. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Dromara UJCMS versions up to and including 12.3.1 are affected. The issue is in the UserController usernameExist function in the CMS API code.
Does exploitation require authentication or user interaction?
No. The reported vector is network-accessible, requires no privileges, and requires no user interaction.
What does an attacker need to manipulate?
The attack involves manipulating the Username argument supplied to the usernameExist function. The reported impact is improper authorization with low confidentiality impact.
Is a fix available from the project?
The provided information does not identify a fixed version. It states that the project received an early issue report but had not responded at the time of reporting.