CVE-2026-97060 X-SpringBoot through 6.0 Authorization Bypass via User Management
Sub-administrators can modify or delete any user, including super admins, due to missing object-level authorization checks in user management endpoints.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-97060?
CVE-2026-97060 is a high-severity missing authorization vulnerability in yzcheng90 X-SpringBoot, published on 25 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.
Weakness: CWE-639
Which versions are affected by CVE-2026-97060?
How do I fix CVE-2026-97060?
No fix has been published for CVE-2026-97060 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-97060 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-97060 exists.
Sources
Also known as GHSA-7mx4-r2xx-g859.