CVE-2026-93961

Overview

Dromara UJCMS up to 12.3.1 contains an improper authorization flaw in the UserController's usernameExist endpoint. Attackers can manipulate the Username parameter to bypass checks and potentially access user data. The vulnerability is exploitable remotely without authentication.

Description

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in improper authorization. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Impact

Confidentiality: potential exposure of user account information. Integrity: unauthorized manipulation of user existence checks. Availability: minimal. Impacted parties: administrators, users, and organizations running affected UJCMS installations.

Remediation

Apply the vendor's patch that fixes the usernameExist authorization check, or upgrade to a version newer than 12.3.1. If a patch is not available, restrict access to the endpoint via firewall or API gateway, enforce strict input validation, and monitor for suspicious username queries.

Risk context

The medium severity score and low EPSS indicate a moderate risk that is unlikely to be widely targeted, but defenders should still address it promptly to prevent potential data exposure.

Affected products

• Dromara UJCMS 12.3.1