CVE-2026-3186

Katalog CVE

CVSS 4.3 · Medium EPSS 0,36%

Kerentanan Use of Default Password pada szadmin sz-boot-parent. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argument userId causes use of default password. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.3.3-beta addresses this issue. Patch name: aefaabfd7527188bfba3c8c9eee17c316d094802. It is suggested to upgrade the affected component. The project was informed beforehand and acted very professional: "We have added authorization validation to the password reset interface; now only users with the corresponding permissions are allowed to perform password resets."

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1393: Use of Default Password

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 patch
• https://github.com/yuccun/CVE/blob/main/sz-boot-parent-VPE_Unauthorized_Password_Reset.md exploit · advisory pihak ketiga
• https://vuldb.com/?ctiid.347744 permissions required · advisory pihak ketiga · vdb entry
• https://vuldb.com/?id.347744 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.754037 advisory pihak ketiga · vdb entry
• https://github.com/feiyuchuixue/sz-boot-parent/ product
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta release notes