Executive brief
A Spring Boot-based e-commerce platform contains an authorization flaw that allows any authenticated user to modify other users' profiles, including the administrator's account. An attacker can change the admin's password and email to seize complete control of the platform, exposing all customer data and operations to compromise.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) authorization bypass in the UserController.updateUser() endpoint (CWE-639). The endpoint accepts a userid parameter directly from the HTTP request without verifying that the authenticated user owns that account before passing it to the updateUserProfile() service method, which blindly performs the update. Any authenticated user, including low-privilege customers (ROLE_NORMAL), can supply an arbitrary userid to modify any account's password, email, and address. Exploitation requires only valid authentication and network access; the attack vector is POST /updateuser with a manipulated userid parameter. An attacker can change the administrator's password and take over the entire system. A pull request to fix this issue is awaiting acceptance.
Affected products
- jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2
Timeline
- 2026-08-03: disclosed: Vulnerability assessment reported in GitHub issue #172
- 2026-09-13: advisory: CVE-2026-90598 published