CVE-2026-97060
X-SpringBoot through 6.0 Authorization Bypass via User Management
yzcheng90 X-SpringBoot
CVSS
8.6HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 29 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.
Text from CVE List
Affected versions 1
- X-SpringBootaffected: all versions through 6.0CVE List
References 4
- vulncheck.com/advisories/x-springboot-through-6.0-authorization-bypass-via-user-managementAdvisoryvia CVE List
- github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/03_user-admin-cross-object-bola.pyExploitvia CVE List
- github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/sys/controller/SysUserController.java#L190-L216Referencevia CVE List
- github.com/yzcheng90/X-SpringBootReferencevia CVE List