CVE-2026-3185

MEDIUM EPSS 35.2%
Published Feb 25, 20264mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 4.0
Medium
Find Similar
Published Feb 25, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.3.3-beta is able to address this issue. The patch is identified as aefaabfd7527188bfba3c8c9eee17c316d094802. The affected component should be upgraded. The project was informed beforehand and acted very professional: "We have implemented message ownership verification, so that users can only query messages related to themselves."

CVSS Details

Base Score
5.5
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
35.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-285
CWE-639

Affected Products 15

VendorProductVersionRange
szadminsz-boot-parent* ≤0.9.0
szadminsz-boot-parent1.0.0any
szadminsz-boot-parent1.0.1any
szadminsz-boot-parent1.0.2any
szadminsz-boot-parent1.1.0any
szadminsz-boot-parent1.2.0any
szadminsz-boot-parent1.2.1any
szadminsz-boot-parent1.2.2any
szadminsz-boot-parent1.2.3any
szadminsz-boot-parent1.2.4any
szadminsz-boot-parent1.2.5any
szadminsz-boot-parent1.2.6any
szadminsz-boot-parent1.3.0any
szadminsz-boot-parent1.3.1any
szadminsz-boot-parent1.3.2any

References 7

  • github.com https://github.com/feiyuchuixue/sz-boot-parent/
    Product
  • github.com https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802
    Patch
  • github.com https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta
    Release Notes
  • github.com https://github.com/yuccun/CVE/blob/main/sz-boot-parent-IDOR_Message_ID_Enumeration.md
    ExploitThird Party Advisory
  • vuldb.com https://vuldb.com/?ctiid.347743
    Permissions RequiredThird Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?id.347743
    Third Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?submit.754036
    Third Party AdvisoryVDB Entry

Remediation

  • github.com https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802
    Patch