CVE-2026-3186

A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argument userId causes use of default password. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.3.3-beta addresses this issue. Patch name: aefaabfd7527188bfba3c8c9eee17c316d094802. It is suggested to upgrade the affected component. The project was informed beforehand and acted very professional: "We have added authorization validation to the password reset interface; now only users with the corresponding permissions are allowed to perform password resets."

• CWE-1393

• https://github.com/feiyuchuixue/sz-boot-parent/Product
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802Patch
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-betaRelease Notes
• https://github.com/yuccun/CVE/blob/main/sz-boot-parent-VPE_Unauthorized_Password_Reset.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.347744Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.347744Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.754037Third Party Advisory, VDB Entry

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31853ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-31854Cursor is a code editor built for programming with AI. Prior…8.8
• CVE-2026-31856Parse Server is an open source backend that can be deployed …9.8
• CVE-2026-31857Craft is a content management system (CMS). Prior to 5.9.9 a…8.8
• CVE-2026-31858Craft is a content management system (CMS). The ElementSearc…8.8
• CVE-2026-31859Craft is a content management system (CMS). The fix for CVE-…6.1
• CVE-2026-31860Unhead is a document head and template manager. Prior to 2.1…6.1
• CVE-2026-31861Cloud CLI (aka Claude Code UI) is a desktop and mobile UI fo…8.8
• CVE-2026-31862Cloud CLI (aka Claude Code UI) is a desktop and mobile UI fo…8.8
• CVE-2026-31863Anytype Heart is the middleware library for Anytype. The cha…4.4
• CVE-2026-31864JumpServer is an open source bastion host and an operation a…6.8
• CVE-2026-31865Elysia is a Typescript framework for request validation, typ…5.3