CVE-2026-110117 in SmartAdmin
Summary
by MITRE • 10/13/2026
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in SmartAdmin versions through 3.30.0 represents a critical failure in access control mechanisms within the AdminProtectController component. This flaw is classified as an Insecure Direct Object Reference or more specifically, a Broken Access Control issue where the application fails to enforce proper authorization checks on sensitive administrative functions. The core technical deficiency lies in the absence of role-based validation for specific endpoints exposed by the controller. While the system correctly authenticates users and assigns them low-privileged employee roles, it erroneously permits these users to invoke methods that are intended exclusively for high-level administrators or security officers. This architectural oversight allows any authenticated user with minimal privileges to interact directly with configuration management interfaces without verifying if they possess the requisite authority to make such changes.
The operational impact of this vulnerability is severe due to the nature of the settings affected, which constitute level-3 system-wide protection mechanisms. By exploiting the unannotated updateConfig endpoint, an attacker can systematically disable critical security controls including login lockout policies and two-factor authentication requirements. Disabling these features effectively removes multi-layered defenses against brute-force attacks and credential stuffing attempts. Furthermore, through the misuse of the batchDelete endpoint associated with login failures, attackers can clear historical records of failed login attempts. This action not only weakens password enforcement rules but also obscures forensic evidence that might otherwise alert security teams to ongoing intrusion attempts or compromised accounts. The ability to manipulate these settings undermines the integrity of the entire authentication framework and leaves the application vulnerable to unauthorized access.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization within the Common Weakness Enumeration taxonomy. In terms of offensive security tactics, it maps directly to ATT&CK technique T1078 Valid Accounts, as exploitation requires initial authentication, followed by T1484 Domain Policy Modification if applied in a broader enterprise context, or more accurately T1531 Account Access Removal for clearing logs and T1621 Multi-Factor Authentication Bypass. The attacker leverages valid credentials to escalate their effective privileges implicitly through misconfigured API endpoints rather than explicit privilege escalation exploits. This scenario highlights the danger of relying solely on authentication without robust authorization checks at every endpoint level, particularly in administrative modules that handle sensitive configuration data.
To mitigate this vulnerability, immediate remediation should focus on implementing strict role-based access control (RBAC) policies for all methods within AdminProtectController. Developers must ensure that endpoints responsible for modifying security configurations are annotated with appropriate permission requirements that verify the user's role against a whitelist of authorized roles before execution. Additionally, input validation and parameter integrity checks should be reinforced to prevent unauthorized data manipulation. It is also recommended to implement comprehensive logging and monitoring for all configuration changes, ensuring that any modification to level-3 protection settings triggers alerts regardless of who initiates them. Regular security audits and static application security testing (SAST) scans can help identify similar missing authorization flaws in other parts of the codebase before they are exploited in production environments.