PT-2026-21907 · Feiyuchuixue · Sz-Boot-Parent

Yuccun · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-3185

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions up to 1.3.2-beta

Description A flaw exists in feiyuchuixue sz-boot-parent up to version 1.3.2-beta that allows for authorization bypass. This occurs through the manipulation of the messageId argument in the /api/admin/sys-message/ API endpoint. The attack can be initiated remotely, and details of an exploit are publicly available. The developers have implemented message ownership verification to address the issue.

Recommendations Upgrade to version 1.3.3-beta.

Exploit

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-3185

Affected Products

Sz-Boot-Parent

References · 10

• 🔥 https://github.com/yuccun/CVE/blob/main/sz-boot-parent-IDOR_Message_ID_Enumeration.md · Exploit
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 · Patch
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta · Patch
• https://osv.dev/vulnerability/CVE-2026-3185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3185 · Security Note
• https://vuldb.com/?submit.754036 · Note
• https://github.com/feiyuchuixue/sz-boot-parent · Note
• https://vuldb.com/?id.347743 · Note
• https://vuldb.com/?ctiid.347743 · Note
• https://twitter.com/CVEnew/status/2026676417984082281 · Twitter Post