CVE-2026-79571

CVE-2026-79571 is a broken access control flaw (CWE-284) in the SellerAuthorizeAspect component of the open-source springboot-project, version 1.0.0: the authorization aspect that is supposed to gate the seller management interfaces fails to enforce authentication. Because the flaw is exploitable over the network without credentials or user interaction (CVSS 3.1 base score 9.1, critical), any unauthenticated attacker who can reach the application can invoke every seller management interface. Successful exploitation allows the attacker to list all products and orders, put products on or off sale, finish or cancel orders, and modify product categories, yielding both disclosure of seller data and unauthorized changes to it. Anyone running springboot-project 1.0.0 with its seller management interfaces reachable, particularly from the internet, is affected. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS currently estimates only about a 0.2% probability of exploitation in the next 30 days.

What to do: No fixed version is documented in the available data, so operators running springboot-project 1.0.0 should restrict network access to the seller management endpoints (allowlisting or fronting them with reverse-proxy authentication) and confirm none are internet-exposed. Review products, orders, and category records for signs of unauthorized changes, and watch the upstream project for a patched release that restores seller authorization in SellerAuthorizeAspect.