Role-Based Access Control Flaw in yzcheng90 X-SpringBoot 6.0
CVE-2025-55948

7.3HIGH

Key Information:

Vendor

yzcheng90

Status
X-SpringBoot
Vendor
CVE Published:
4 December 2025

What is CVE-2025-55948?

The vulnerability in yzcheng90 X-SpringBoot 6.0 arises from an ineffective implementation of role-based access control (RBAC), correlating frontend menu systems with backend permission tables. This design flaw lacks atomic synchronization, resulting in a situation where modifications to the frontend permissions do not reflect immediately in the backend. As a result, unauthorized API requests can succeed despite visible access restrictions in the UI. Attackers can exploit this flaw to perform privileged actions that they should not have the authority for, such as creating unauthorized user accounts or accessing confidential information.

References

https://github.com/yzcheng90/X-SpringBoot
https://github.com/liuchengjie01/vuln_db/blob/master/x-sp...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.