CVE-2026-110117highCWE-862

CVE-2026-110117: falha de alta gravidade em 1024-lab SmartAdmin

SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SmartAdmin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.3%
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
1024-lab · SmartAdmin
CVEs relacionadas — 1024-lab SmartAdmin

No mesmo produto, das mais perigosas para as menos.

CVE-2026-3725MEDIUM1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engineEPSS 0.5%CVE-2026-3721MEDIUM1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scriptingEPSS 0.3%CVE-2026-3720MEDIUM1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scriptingEPSS 0.3%