CVE-2026-3186 - Vulnerability Analysis

Overview

feiyuchuixue sz-boot-parent <= 1.3.2-beta contains a broken access control caused by lack of authorization validation in password reset handler, letting remote attackers reset passwords using default credentials, exploit requires attacker to have appropriate permissions.

Severity & Score

Impact

Attackers can reset user passwords remotely, potentially leading to account takeover and privilege escalation.

Mitigation

Upgrade to version 1.3.3-beta.

References

• https://github.com/yuccun/CVE/blob/main/sz-boot-parent-VPE_Unauthorized_Password_Reset.md
• https://vuldb.com/?ctiid.347744
• https://vuldb.com/?id.347744
• https://vuldb.com/?submit.754037
• https://github.com/feiyuchuixue/sz-boot-parent/
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner