CVE-2026-97060: X-SpringBoot through 6.0 Authorization Bypass via User Management
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have user-management permissions, such as a sub-administrator. No user interaction is required, and the affected endpoints are reachable over the network.
What actions could an attacker take through the affected endpoints?
A permitted sub-administrator can modify or delete users without ownership verification. This includes resetting passwords for arbitrary accounts, including the super administrator, rebinding roles, and deleting users via POST /sys/user/update or POST /sys/user/delete.
How can I determine whether my deployment is exposed?
Review whether X-SpringBoot is version 6.0 or earlier and whether accounts other than the super administrator have user-management permissions. Test authorization controls on POST /sys/user/update and POST /sys/user/delete to verify that such accounts cannot act on users outside their ownership or intended administrative scope.