CVE-2026-111365 in cool-admin-midway
Summary
by MITRE • 10/16/2026
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in cool-admin-midway versions through 8.0.0 represents a critical failure in server-side authorization logic, specifically categorized under CWE-269 Improper Control of Interaction with an Untrusted Entity and often associated with Broken Access Control as defined by the OWASP Top Ten. This flaw allows users possessing standard administrative privileges to escalate their influence beyond intended boundaries by manipulating role identifiers during routine operations. The core technical deficiency lies in the application's failure to validate whether the requesting user has explicit permission to modify, view, or delete a specific resource based on ownership or hierarchical authority. Instead of verifying that the actor initiating the request is the owner of the target role or holds super-administrator status, the backend endpoints simply accept and process arbitrary role identifiers provided in the HTTP payload.
From an operational perspective, this authorization bypass enables significant disruption to system integrity and security posture. An attacker with basic sys:role permissions can interact directly with API endpoints such as /admin/sys/role/info, update, or delete by supplying a target role ID that belongs to another administrator account. By successfully executing these actions, the attacker gains the ability to rewrite menu configurations and departmental grants associated with other admin accounts. This manipulation effectively alters the effective access rights of targeted users, potentially stripping them of necessary permissions or granting them unintended privileges depending on how the role data is modified. Such changes can lead to unauthorized data exposure, privilege escalation for lower-level admins, or complete denial of service if critical administrative functions are disabled through malicious role reconfiguration.
This type of vulnerability aligns with MITRE ATT&CK techniques related to Privilege Escalation and Defense Evasion, as it allows an authenticated user to bypass intended security restrictions without exploiting a software bug in the traditional sense but rather by abusing valid API functionality. The impact extends beyond simple data modification; it compromises the trust model of multi-tenant or role-based access control systems where distinct administrative boundaries are expected to remain rigid. If left unpatched, this flaw could be chained with other vulnerabilities to achieve full system compromise, as altering role definitions can indirectly affect authentication flows and audit logging mechanisms that rely on accurate user-role mappings.
Mitigation strategies must focus on implementing robust server-side access control checks at the API layer. Developers should enforce strict ownership verification or hierarchical permission validation before processing any request involving resource modification. Specifically, when handling requests to update or delete role information, the system must verify that the authenticated session holds super-administrator privileges or is explicitly authorized for the specific target role ID. Additionally implementing principle of least privilege ensures that default permissions do not grant broad write access over administrative structures without explicit justification. Regular security audits and static code analysis focused on authorization logic can help identify similar patterns in other endpoints, ensuring comprehensive protection against broken access control vulnerabilities across the application surface.