GHSA-53v5-9752-qq92
NutzBoot Incorrect Privilege Assignment vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.nutz:nutzboot-parent | <= 2.6.0-SNAPSHOT | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This impacts an unknown function of the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java of the component Transaction API. The manipulation of the argument from/to/wei leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-13806
- https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md
- https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md#vulnerability-details-and-poc
- https://github.com/nutzam/nutzboot
- https://vuldb.com/?ctiid.333816
- https://vuldb.com/?id.333816
- https://vuldb.com/?submit.692061