CVE-2026-111723 in LingGuo-Drama
Summary
by MITRE • 10/16/2026
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in LingGuo-Drama represents a critical failure in access control mechanisms within the application's administrative interface. Specifically, commit 8a6924a introduced or exposed an endpoint at /admin/v1/admins that is intended to be restricted to high-privilege administrators but is instead protected only by AuthAdminJWT without sufficient role-based verification logic. This architectural flaw allows any authenticated user who possesses a valid JWT token for the application, regardless of their assigned privilege level, to interact with this administrative endpoint as if they were a system administrator. The core technical issue lies in the server-side validation process which checks for the presence and validity of the authentication token but fails to verify that the principal associated with that token holds the necessary permissions to perform actions on other user accounts or modify administrative configurations. This is a classic example of an insecure direct object reference combined with broken access control, where the application trusts client-supplied identifiers or session tokens without enforcing strict authorization policies at the resource level.
From an operational perspective, this vulnerability grants attackers comprehensive control over the entire user base and potentially the system's initial configuration. By exploiting this flaw, a malicious actor can first self-register to obtain valid credentials and subsequently use those credentials to access the vulnerable endpoint. Once authenticated, the attacker can read sensitive data from every account in the database, specifically extracting bcrypt hashes which are critical for offline password cracking attacks if additional security measures like salting or pepper are not adequately implemented elsewhere. Furthermore, the ability to reset the bootstrap administrator's password via a PUT request allows the attacker to seize permanent control of the administrative panel by changing the credentials of the highest-privilege account. The capability to raise their own authority_id enables lateral movement within the application’s privilege hierarchy, effectively elevating the attacker from a standard user to an admin role without needing further exploitation steps. Additionally, the ability to delete accounts constitutes a severe availability risk, allowing for denial-of-service attacks against specific users or mass data destruction if applied broadly.
This vulnerability maps directly to CWE-269 Improper Privilege Control and CWE-862 Missing Authorization in the Common Weakness Enumeration taxonomy. In terms of offensive security frameworks, this behavior aligns with MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to gain access, followed by T1078.003 Cloud Accounts or general account manipulation techniques depending on the deployment context. The exploitation path involves initial access through self-registration, privilege escalation via authority_id modification, and credential access through password reset capabilities. To mitigate this vulnerability, developers must implement strict role-based access control checks at every endpoint that handles sensitive administrative functions. This includes verifying not just that a user is authenticated but also that their specific role or permission set authorizes the requested action on the target resource. Input validation should ensure that users can only modify their own records unless explicitly authorized for cross-account operations, and critical actions like password resets for super-administrators should require multi-factor authentication or additional administrative approval workflows to prevent unauthorized privilege escalation and account takeover.