CVE-2026-90598

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypass. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance.

• CWE-285
• CWE-639

• https://github.com/jaygajera17/E-commerce-project-springBoot/
• https://github.com/jaygajera17/E-commerce-project-springBoot/issues/172
• https://github.com/jaygajera17/E-commerce-project-springBoot/pull/174
• https://github.com/user-attachments/files/30648539/poc_idor_updateuser.py
• https://vuldb.com/cve/CVE-2026-90598
• https://vuldb.com/submit/913792
• https://vuldb.com/vuln/403180
• https://vuldb.com/vuln/403180/cti

Published

Sep 13, 2026

Last Modified

Sep 13, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9059NextGEN Gallery version prior to 4.2.1 are vulnerable to aut…9.3
• CVE-2026-90593A vulnerability was determined in embedded-graphics up to 0.…7.3
• CVE-2026-90594A vulnerability was identified in wxiaoqi Spring-Cloud-Platf…6.3
• CVE-2026-90595A security flaw has been discovered in wxiaoqi Spring-Cloud-…6.3
• CVE-2026-90596A weakness has been identified in embedded-graphics up to 0.…6.5
• CVE-2026-90597A security vulnerability has been detected in itsourcecode S…6.3
• CVE-2026-90599A flaw has been found in Rizwan17 inventory-management-syste…4.3
• CVE-2026-9060The Store Locator WordPress plugin before 1.6.6 does not san…3.5
• CVE-2026-9061The Store Locator WordPress plugin before 1.6.9 does not san…3.5
• CVE-2026-90616In Flatpak before 1.18.1, a malicious sandboxed app can obta…7.4
• CVE-2026-9062The Store Locator WordPress plugin before 1.6.9 does not val…3.4
• CVE-2026-9064A flaw was found in 389-ds-base. The get_ldapmessage_control…7.5