dbcve.org
Incorrect Privilege AssignmentWeakness · CWE-266

CVE-2026-11521

MEDIUM · 6.3 CVSS v3.1 Published 2026-06-08
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
69/100
Remediation priority · Elevated
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controller/TransactionController.java of the component Transaction Endpoint. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

Improper authorization vulnerability in the TransactionController.java of a Spring Boot banking management system allows remote attackers to bypass access controls on transaction endpoints, likely enabling unauthorized access to or manipulation of transaction data.

MitigationImplement proper authorization checks (e.g., @PreAuthorize, method-level security) on transaction endpoints and enforce user-specific transaction access to ensure users can only access their own transactions.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Locate TransactionController.java in your codebase
    Search your source code for the file TransactionController.java, typically found under src/main/java in a controller or api package. Examine its imports and class annotations.
    Affected if The file exists and contains transaction-related endpoint mappings (e.g., @GetMapping, @PostMapping, @PutMapping, @DeleteMapping) without Spring Security annotations like @PreAuthorize, @Secured, or method-level security configuration.
  2. Verify Spring Security configuration on transaction endpoints
    Inspect your WebSecurityConfig or SecurityFilterChain bean configuration. Look for antMatchers or requestMatchers that define authorization rules for /transaction/** or similar transaction URL patterns.
    Affected if Transaction endpoints are not explicitly secured with permitAll() or missing from secured URL patterns, indicating no role-based restrictions are defined.
  3. Check for method-level authorization annotations
    In TransactionController.java, review each endpoint method for @PreAuthorize, @Secured, or @RolesAllowed annotations that restrict access based on user roles or permissions.
    Affected if No method-level authorization annotations are present on transaction operation methods, or they allow all authenticated users without role validation.
  4. Inspect the banking system deployment
    If you have a deployed WAR or JAR file, examine the compiled classes or decompile TransactionController.class to verify the runtime implementation matches your source code review.
    Affected if The deployed controller lacks the security checks found in the source code or no security annotations are present at all.
  5. Test endpoint access control behavior
    Using an HTTP client, attempt to access transaction endpoints with a low-privilege or unauthenticated user account. Compare the HTTP response against expected authorization behavior.
    Affected if Transactions are returned, modified, or deleted successfully without proper role-based authorization, returning 200 OK instead of 403 Forbidden.

You are affected if TransactionController.java lacks Spring Security authorization annotations (like @PreAuthorize) on its transaction endpoints and your Spring Security configuration does not restrict access by role.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Implement proper authorization checks (e.g., @PreAuthorize, method-level security) on transaction endpoints and enforce user-specific transaction access to ensure users can only access their own transactions.

Have this fixed Scoped from the published advisory
  • Consultation3.0 h
  • Implementation6.0 h
  • Testing4.0 h
  • Review / QA2.0 h
15.0 hours of engineering $2,640
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,224.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-11521 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-11521 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data