CVE-2025-55948 is a high-severity access control vulnerability in yzcheng90 X-SpringBoot 6.0, stemming from a desynchronization between frontend menu updates and backend permission tables. This allows attackers to bypass revoked privileges by directly accessing API endpoints, despite UI elements disappearing. With a CVSS score of 7.3, this flaw enables unauthorized creation of high-privilege accounts, sensitive data access, and execution of admin commands. There is currently no known active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.0CPE matchmatch criteria | cpe:2.3:a:yzcheng90:x-springboot:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.