SpringBlade versions 2.7.3 through 3.5.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.

SpringBlade versions 2.7.3 through 3.5.0 are affected by a privilege escalation vulnerability tracked as CVE-2026-56100. Authenticated attackers can exploit an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks to create system administrator accounts. The gateway's authentication filter only validates JWT parsing without verifying user roles or caller identity, making it insufficient as a security control. A hardcoded JWT signing key embedded in publicly available JARs allows attackers to forge valid tokens and escalate privileges from low-privilege user to administrator. Successful exploitation enables cross-tenant data pollution and persistent backdoor access. The vulnerability affects a widely used Java microservices framework. A fix is available in SpringBlade v5.0.0 as indicated by the referenced commit and release notes.