CVE-2026-97368

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-285
• CWE-639

• https://aibot88.github.io/CVERequest/SpringBlade/issue2.html
• https://vuldb.com/cve/CVE-2026-97368
• https://vuldb.com/submit/909894
• https://vuldb.com/vuln/409352
• https://vuldb.com/vuln/409352/cti

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97359HFS2 version 2.4.0 and earlier contains a template injection…10
• CVE-2026-9736IBM Netezza Software 11.3.0.3 through Interim Fix 002 could …4.3
• CVE-2026-97360HFS2 version 2.4.0 and earlier contains an unauthenticated a…10
• CVE-2026-97362HFS2 version 2.4.0 and earlier contains a denial of service …7.5
• CVE-2026-97365A vulnerability was determined in chonkie-inc littrs 0.6.1/0…6.3
• CVE-2026-97366A security flaw has been discovered in jhen0409 react-native…6.3
• CVE-2026-9737During query planning when reading the sort pattern in raw B…7.1
• CVE-2026-9738The Print, PDF, Email by PrintFriendly plugin for WordPress …4.4
• CVE-2026-97387Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-9739Vulnerable to DNS rebinding attacks when using SSE (http://b…9.4
• CVE-2026-9740A vulnerability in MongoDB Server's BSON validation logic al…8.7
• CVE-2026-97404In OpenStack Zaqar before 22.0.2, WSGI transport mishandles …9.2