CVE-2026-97060High· 7.2▾ TwilightX-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.
X-SpringBoot <= 6.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100192Medium· 6.5X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
CVE-2026-97064Critical· 9.1X-SpringBoot through 6.0 Authentication Bypass via Static Master Code
CVE-2026-97063Critical· 9.1X-SpringBoot through 6.0 Authentication Bypass via Login Code
CVE-2021-46416High· 8.1Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
CVE-2025-14459High· 8.5A flaw was found in KubeVirt Containerized Data Importer (CDI)
CVE-2026-20897Critical· 9.1Gitea does not properly validate repository ownership when deleting Git LFS locks