SpringBlade contains a critical privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts, potentially leading to full system compromise.

This vulnerability is a missing authorization flaw (CWE-862) occurring because an internal Feign user-creation endpoint is inadvertently exposed via a @RestController. Authenticated users can bypass role checks at the gateway, which fails to verify user identity or caller authorization, enabling the creation of unauthorized administrator accounts.

The ability for an authenticated user to elevate privileges to a system administrator poses a severe risk to organizational security. An attacker can perform cross-tenant data pollution, exfiltrate sensitive information, and establish persistent backdoor access to the platform. Given the high CVSS score of 8.1, this flaw represents a significant threat to the integrity and confidentiality of the entire service environment.

Immediate Action: Update the SpringBlade platform to version 5.0.0 or later immediately, as this version removes the vulnerable endpoint and implements proper internal interface interception.

Proactive Monitoring: Review application logs for suspicious POST requests directed at user-creation endpoints, specifically looking for unauthorized attempts to invoke the save-user function.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to block external access to internal service paths and specifically restrict access to any endpoint containing /user/save-user.

Public Exploit Available: Yes, a technical write-up and proof-of-concept are available via the referenced GitHub Gist.

The severity of this privilege escalation vulnerability necessitates an immediate response. Administrators must prioritize upgrading to version 5.0.0 to eliminate the exposure of internal Feign endpoints. Failure to patch will leave the environment vulnerable to complete administrative takeover by any authenticated user.