CVE-2026-56100

SpringBlade versions 2.7.3 up to but not including 5.0.0 expose an internal Feign user-creation endpoint through a @RestController with no authorization check (CWE-862). An authenticated attacker holding a low-privilege account can send a crafted POST request to this endpoint to create a new system administrator account. The gateway's authentication filter only validates that the JWT parses and does not verify user roles or caller identity, and the JWT signing key is hardcoded in publicly available JARs, allowing attackers to forge valid tokens as part of the escalation path. Successful exploitation yields administrator privileges, enabling cross-tenant data pollution and persistent backdoor access via the attacker-created admin account. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known; EPSS is 0.3%.

What to do: Upgrade to SpringBlade 5.0.0 or later. As interim mitigation, add an explicit authorization check to the user-creation endpoint (or remove its public @RestController exposure), replace the hardcoded JWT signing key with a unique secret per deployment, and configure the gateway authentication filter to verify user roles and caller identity. Audit user tables for unexpected administrator accounts created recently.