CVE-2026-111366 in cool-admin-midway
Summary
by MITRE • 10/16/2026
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in cool-admin-midway versions through 8.0.0 represents a critical authorization bypass flaw rooted in insufficient server-side access control mechanisms. This specific weakness allows administrators with restricted departmental scopes to circumvent their assigned permissions by manipulating input parameters, specifically user identifiers. In typical role-based or attribute-based access control systems, an admin limited to managing users within a specific organizational unit should only be able to perform actions on records belonging to that unit. However, the application fails to validate whether the target resource belongs to the requester's authorized domain before processing administrative requests. This architectural oversight enables attackers who possess basic user management permissions, such as sys:user:*, to escalate their privileges effectively by targeting arbitrary user accounts regardless of departmental boundaries.
From a technical perspective, the exploitation vector involves interacting with specific API endpoints including /admin/sys/user/info for reading data, and update or delete operations for modifying account states. By supplying an arbitrary user ID in these requests, an attacker can bypass the intended filtering logic that restricts access to their own department's roster. This lack of object-level authorization check means the backend processes the request based solely on the presence of a valid session token with basic permissions, ignoring the contextual relationship between the authenticated admin and the target resource. Consequently, this flaw facilitates unauthorized data disclosure, allowing attackers to extract sensitive personal information associated with users outside their purview.
The operational impact of this vulnerability is severe due to the potential for account takeover and system compromise. Attackers can reset passwords for high-privilege accounts, effectively taking control over critical administrative functions without needing to guess or brute-force credentials. Furthermore, they can modify user roles, potentially promoting a low-level account to an administrator level with broader permissions. The ability to delete arbitrary accounts also poses a significant risk of denial-of-service against specific users and can disrupt organizational workflows by removing essential personnel from the system. This chain of actions demonstrates how a single authorization bypass can lead to comprehensive loss of integrity and availability within the application environment.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting failures in enforcing restrictions on what authenticated users are allowed to do. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials that have been misused due to poor access control policies. To mitigate this issue, developers must implement strict object-level authorization checks at the service layer for all administrative endpoints. This involves verifying that the user ID being accessed or modified belongs to a department associated with the currently authenticated admin's profile before executing any database operations. Additionally, adopting principle of least privilege and conducting regular security audits on access control logic can prevent similar bypasses in future development cycles.