CVE-2026-11521

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11521", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-07T16:04:49.354Z", "datePublished": "2026-06-08T14:15:13.117Z", "dateUpdated": "2026-06-08T16:29:03.805Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-08T14:15:13.117Z"}, "title": "Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "Mohammed-eid35", "product": "bank-management-system-springboot", "versions": [{"version": "7b9bcc65ad7df3db29af71aed9bb500e5f24d948", "status": "affected"}], "cpes": ["cpe:2.3:a:mohammed-eid35:bank-management-system-springboot:*:*:*:*:*:*:*:*"], "modules": ["Transaction Endpoint"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controller/TransactionController.java of the component Transaction Endpoint. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-06-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-07T18:09:52.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "wr0ld (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/369141", "name": "VDB-369141 | Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/369141/cti", "name": "VDB-369141 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11521", "name": "CVE-2026-11521 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/836452", "name": "Submit #836452 | Mohammed-eid35 bank-management-system-springboot 1 Authentication Bypass by Primary Weakness", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Mohammed-eid35/bank-management-system-springboot/issues/8", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Mohammed-eid35/bank-management-system-springboot/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T16:28:54.673004Z", "id": "CVE-2026-11521", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T16:29:03.805Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11521", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T16:28:54.673004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T16:28:59.402Z"}}], "cna": {"title": "Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization", "credits": [{"lang": "en", "type": "reporter", "value": "wr0ld (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:mohammed-eid35:bank-management-system-springboot:*:*:*:*:*:*:*:*"], "vendor": "Mohammed-eid35", "modules": ["Transaction Endpoint"], "product": "bank-management-system-springboot", "versions": [{"status": "affected", "version": "7b9bcc65ad7df3db29af71aed9bb500e5f24d948"}]}], "timeline": [{"lang": "en", "time": "2026-06-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-07T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-07T18:09:52.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/369141", "name": "VDB-369141 | Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/369141/cti", "name": "VDB-369141 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11521", "name": "CVE-2026-11521 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/836452", "name": "Submit #836452 | Mohammed-eid35 bank-management-system-springboot 1 Authentication Bypass by Primary Weakness", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Mohammed-eid35/bank-management-system-springboot/issues/8", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Mohammed-eid35/bank-management-system-springboot/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controller/TransactionController.java of the component Transaction Endpoint. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-08T14:15:13.117Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11521", "state": "PUBLISHED", "dateUpdated": "2026-06-08T16:29:03.805Z", "dateReserved": "2026-06-07T16:04:49.354Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-08T14:15:13.117Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:mohammed-eid35:bank-management-system-springboot:*:*:*:*:*:*:*:*"], "modules": ["Transaction Endpoint"], "product": "bank-management-system-springboot", "vendor": "Mohammed-eid35", "versions": [{"status": "affected", "version": "7b9bcc65ad7df3db29af71aed9bb500e5f24d948"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controller/TransactionController.java of the component Transaction Endpoint. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en Mohammed-eid35 bank-management-system-springboot hasta la versi\u00f3n 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. Esto afecta una parte desconocida del archivo src/main/java/com/alien/bank/management/system/controller/TransactionController.java del componente Transaction Endpoint. Dicha manipulaci\u00f3n conduce a una autorizaci\u00f3n indebida. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Este producto adopta el enfoque de lanzamientos continuos para proporcionar entrega continua. Por lo tanto, los detalles de la versi\u00f3n para las versiones afectadas y actualizadas no est\u00e1n disponibles. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-11521", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11521", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T16:28:54.673004Z", "version": "2.0.3"}}]}, "published": "2026-06-08T15:16:44.000", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Mohammed-eid35/bank-management-system-springboot/"}, {"source": "cna@vuldb.com", "url": "https://github.com/Mohammed-eid35/bank-management-system-springboot/issues/8"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-11521"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/836452"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369141"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369141/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "7b9bcc65ad7df3db29af71aed9bb500e5f24d948"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "bank-management-system-springboot", "source": "cna", "vendor": "Mohammed-eid35"}, "product": "bank-management-system-springboot", "vendor": "mohammed-eid35"}], "created": "2026-06-08T16:00:16.625269+00:00", "updated": "2026-06-09T08:57:05.570747+00:00", "vendors": ["mohammed-eid35", "mohammed-eid35$PRODUCT$bank-management-system-springboot"]}