CVE-2026-97368

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-285
• CWE-639

• https://aibot88.github.io/CVERequest/SpringBlade/issue2.html
• https://vuldb.com/cve/CVE-2026-97368
• https://vuldb.com/submit/909894
• https://vuldb.com/vuln/409352
• https://vuldb.com/vuln/409352/cti

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97360HFS2 version 2.4.0 and earlier contains an unauthenticated a…10
• CVE-2026-97362HFS2 version 2.4.0 and earlier contains a denial of service …7.5
• CVE-2026-97363The WebSocket Application Programming Interface lacks restri…7.5
• CVE-2026-97365A vulnerability was determined in chonkie-inc littrs 0.6.1/0…6.3
• CVE-2026-97366A security flaw has been discovered in jhen0409 react-native…6.3
• CVE-2026-97367A flaw was found in the Keycloak Account REST API where it i…6.4
• CVE-2026-9737During query planning when reading the sort pattern in raw B…6.5
• CVE-2026-97370Junrar is an open source Java RAR archive library. Prior to …7.5
• CVE-2026-97371ntopng is a web-based network traffic monitoring application…5.3
• CVE-2026-97373draw.io is a configurable diagramming and whiteboarding appl…5.8
• CVE-2026-97377SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-9738The Print, PDF, Email by PrintFriendly plugin for WordPress …4.4