CVE-2026-3185 - Vulnerability Analysis

Overview

feiyuchuixue sz-boot-parent <= 1.3.2-beta contains an authorization bypass caused by improper message ownership verification in /api/admin/sys-message/, letting remote attackers bypass authorization, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can bypass authorization to access or manipulate messages not belonging to them.

Mitigation

Upgrade to version 1.3.3-beta.

References

• https://vuldb.com/?submit.754036
• https://github.com/feiyuchuixue/sz-boot-parent/
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta
• https://github.com/yuccun/CVE/blob/main/sz-boot-parent-IDOR_Message_ID_Enumeration.md
• https://vuldb.com/?ctiid.347743
• https://vuldb.com/?id.347743

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner