CVE-2026-3186

A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argument userId causes use of default password. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.3.3-beta addresses this issue. Patch name: aefaabfd7527188bfba3c8c9eee17c316d094802. It is suggested to upgrade the affected component. The project was informed beforehand and acted very professional: "We have added authorization validation to the password reset interface; now only users with the corresponding permissions are allowed to perform password resets."

CVSS v3 6.3 MEDIUM
CVSS v2.0 6.5 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/feiyuchuixue/sz-boot-parent/	Product
https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802	Patch
https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta	Release Notes
https://github.com/yuccun/CVE/blob/main/sz-boot-parent-VPE_Unauthorized_Password_Reset.md	Exploit Third Party Advisory
https://vuldb.com/?ctiid.347744	Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.347744	Third Party Advisory VDB Entry
https://vuldb.com/?submit.754037	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:szadmin:sz-boot-parent::::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.0.0:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.0.1:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.0.2:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.1.0:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.2.0:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.2.1:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.2.2:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.2.3:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.2.4:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.2.5:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.2.6:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.3.0:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.3.1:beta::::::
	cpe:2.3:a:szadmin:sz-boot-parent:1.3.2:beta::::::

History

29 Apr 2026, 01:00

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue determinada en feiyuchuixue sz-boot-parent hasta 1.3.2-beta. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo /api/admin/sys-user/reset/password/ del componente Gestor de Restablecimiento de Contraseña. Esta manipulación del argumento userId causa el uso de contraseña por defecto. El ataque puede ser iniciado remotamente. El exploit ha sido divulgado públicamente y puede ser utilizado. La actualización a la versión 1.3.3-beta aborda este problema. Nombre del parche: aefaabfd7527188bfba3c8c9eee17c316d094802. Se sugiere actualizar el componente afectado. El proyecto fue informado de antemano y actuó de manera muy profesional: 'Hemos añadido validación de autorización a la interfaz de restablecimiento de contraseña; ahora solo los usuarios con los permisos correspondientes pueden realizar restablecimientos de contraseña.'

26 Feb 2026, 15:53

Type	Values Removed	Values Added
First Time		Szadmin Szadmin sz-boot-parent
References	~~() https://github.com/feiyuchuixue/sz-boot-parent/ -~~	() https://github.com/feiyuchuixue/sz-boot-parent/ - Product
References	~~() https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 -~~	() https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 - Patch
References	~~() https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta -~~	() https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta - Release Notes
References	~~() https://github.com/yuccun/CVE/blob/main/sz-boot-parent-VPE_Unauthorized_Password_Reset.md -~~	() https://github.com/yuccun/CVE/blob/main/sz-boot-parent-VPE_Unauthorized_Password_Reset.md - Exploit, Third Party Advisory
References	~~() https://vuldb.com/?ctiid.347744 -~~	() https://vuldb.com/?ctiid.347744 - Permissions Required, Third Party Advisory, VDB Entry
References	~~() https://vuldb.com/?id.347744 -~~	() https://vuldb.com/?id.347744 - Third Party Advisory, VDB Entry
References	~~() https://vuldb.com/?submit.754037 -~~	() https://vuldb.com/?submit.754037 - Third Party Advisory, VDB Entry
CPE		cpe:2.3:a:szadmin:sz-boot-parent:1.0.1:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.2.2:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.0.0:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.1.0:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.0.2:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.3.0:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.3.2:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.2.1:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.2.4:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.2.6:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.3.1:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.2.5:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:1.2.3:beta:::::: cpe:2.3:a:szadmin:sz-boot-parent:::::::: cpe:2.3:a:szadmin:sz-boot-parent:1.2.0:beta::::::

25 Feb 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-25 14:16

Updated : 2026-04-29 01:00

NVD link : CVE-2026-3186

Mitre link : CVE-2026-3186

CVE.ORG link : CVE-2026-3186

JSON object : View

Products Affected

szadmin

sz-boot-parent

CWE

CWE-1393

Use of Default Password

6.3 /10