CVE-2026-100192

MediumCVSS 6.5/10Last modified Sep 29, 2026

Description

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 25, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1001934.7The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' para CVE-2026-1001967.2The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comme CVE-2026-10025.3The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically CVE-2026-100208.3Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had com CVE-2026-1002007.0Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-1002017.0Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.CVE-2026-1002029.8Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.CVE-2026-1002037.0Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-1002057.1Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.CVE-2026-1002077.3Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker CVE-2026-1002088.1Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1002098.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.