PT-2026-21907 · Feiyuchuixue · Sz-Boot-Parent

Yuccun · Publicado 2026-02-25 · Atualizado 2026-02-25 · CVE-2026-3185

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions up to 1.3.2-beta

Description A flaw exists in feiyuchuixue sz-boot-parent up to version 1.3.2-beta that allows for authorization bypass. This occurs through the manipulation of the messageId argument in the /api/admin/sys-message/ API endpoint. The attack can be initiated remotely, and details of an exploit are publicly available. The developers have implemented message ownership verification to address the issue.

Recommendations Upgrade to version 1.3.3-beta.

Exploit

Correção

IDOR

Improper Authorization

Enumeração de Fraquezas

CWE-639

CWE-285

Identificadores relacionados

CVE-2026-3185

Produtos afetados

Sz-Boot-Parent

Referências · 10

• 🔥 https://github.com/yuccun/CVE/blob/main/sz-boot-parent-IDOR_Message_ID_Enumeration.md · Exploit
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 · Correção
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta · Correção
• https://vuldb.com/?submit.754036 · Nota
• https://github.com/feiyuchuixue/sz-boot-parent · Nota
• https://vuldb.com/?id.347743 · Nota
• https://vuldb.com/?ctiid.347743 · Nota
• https://osv.dev/vulnerability/CVE-2026-3185 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2026676417984082281 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3185 · Nota de Segurança