A vulnerability labeled as critical has been found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass.
This vulnerability is reported as CVE-2026-3185. The attack can be launched remotely. Moreover, an exploit is present.
The affected component should be upgraded.
The project was informed beforehand and acted very professional: “We have implemented message ownership verification, so that users can only query messages related to themselves.”
