Description

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in improper authorization. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-20T05:16:28.093Z",
  "pubdate": "2026-09-20T05:16:28.093Z",
  "executiveSummary": "A critical security flaw exists in Dromara UJCMS up to version 12.3.1, specifically within the usernameExist function of the UserController component.\nThe vulnerability is categorized as an improper authorization issue, which can be exploited remotely by an unauthenticated attacker.\nBy manipulating the 'Username' argument during a request to the affected API endpoint, an attacker can bypass authorization constraints designed to protect user account information.\nThis flaw poses a significant privacy and reconnaissance risk, as it may allow unauthorized actors to enumerate existing usernames within the system.\nThe vulnerability is exacerbated by the lack of a vendor response to initial disclosure, leaving systems exposed to potential exploitation.\nSuccessful exploitation does not require prior authentication, making the attack vector highly accessible for remote adversaries.",
  "technicalDetails": "The vulnerability resides in the UserController.java file, specifically within the usernameExist function located in the path ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java.\nThe root cause is an improper authorization check that fails to properly validate the context or identity of the requester when processing requests to verify the existence of a username.\nThe application exposes an API endpoint intended for checking whether a specific username is already registered in the system. The implementation of this function fails to enforce adequate access control mechanisms, permitting external callers to query the system's user database.\nAn attacker can exploit this flaw by sending a crafted HTTP request to the vulnerable endpoint with a manipulated 'Username' parameter. Since the function lacks sufficient authorization logic, the application processes the input and returns a response indicating the validity or existence of the queried username.\nThe attack flow follows a straightforward pattern: 1) The attacker identifies the endpoint associated with the usernameExist function. 2) The attacker submits a series of HTTP requests using various username permutations or lists. 3) The application, failing to restrict these requests, confirms the existence of accounts based on the function's return values. 4) This allows for automated account enumeration, which can be used to gather valid targets for further attacks, such as credential stuffing or targeted phishing campaigns.\nBecause the function is remotely accessible and does not verify the requester's identity or authorization status, the attack surface is exposed to any network entity capable of reaching the UJCMS deployment.\nPost-exploitation impact includes the systematic enumeration of valid user accounts. This information disclosure provides attackers with a confirmed list of valid usernames, which significantly lowers the barrier for subsequent unauthorized access attempts or brute-force attacks against user accounts.\nThe vulnerability affects all Dromara UJCMS versions up to and including 12.3.1. There is no indication that the underlying security logic correctly implements role-based access control or rate-limiting for this specific API function, leading to the observed improper authorization state."
}