CVE-2024-12483mediumCWE-285CWE-639

CVE-2024-12483: medium-severity vulnerability in Dromara UJCMS

Dromara UJCMS User ID id authorization

Published

Follow this CVE+ Monitor UJCMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.3epss 3.6%
from disclosure to weapon128 days
Published on NVDDec 11
1st PoC+128d
In short

A flaw in Dromara UJCMS allows attackers to bypass authorization checks when accessing user information through the /users/id endpoint. This means an attacker might be able to view or access user data they shouldn't have permission to see.

Technical detail

An authorization bypass vulnerability exists in the User ID Handler component of Dromara UJCMS up to version 9.6.3 affecting the /users/id endpoint. The vulnerability stems from improper access control (CWE-285, CWE-639), allowing remote attackers to circumvent authentication mechanisms; successful exploitation requires moderate attack complexity and specific preconditions but could lead to unauthorized access to user resources.

Summary generated and translated by AI from the official description.
A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Dromara · UJCMS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Dromara UJCMS

In the same product, most dangerous first.

CVE-2026-2953MEDIUMDromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversalEPSS 0.9%CVE-2026-93961MEDIUMDromara UJCMS UserController UserController.java usernameExist improper authorizationEPSS 0.6%CVE-2026-78140MEDIUMDromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engineEPSS 0.4%CVE-2026-2954MEDIUMDromara UJCMS ImportDataController import-channel importChanel injectionEPSS 0.4%