CVE-2026-121543 in smart-sso
Summary
by MITRE • 11/03/2026
smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The security flaw identified in smart-sso versions up to 2.0.1 represents a critical failure in access control mechanisms within the PermissionFilter component of the application architecture. This vulnerability stems from an insecure default configuration where unlisted URL paths are implicitly permitted rather than denied by default. In secure system design, particularly for administrative interfaces, the principle of least privilege dictates that any request not explicitly authorized should be rejected. However, due to this implementation error, the filter fails to enforce strict path-based restrictions on authenticated users who interact with the admin console APIs. This architectural oversight effectively bypasses intended security boundaries, allowing any user possessing valid authentication credentials to access endpoints reserved for system administrators without requiring elevated privileges or additional authorization checks.
The operational impact of this vulnerability is severe and directly compromises the integrity and confidentiality of the entire integrated identity management ecosystem. An attacker who has obtained legitimate login credentials can exploit the unrestricted access to specific administrative endpoints, most notably /admin/user-role/save. By invoking this endpoint with crafted parameters, an attacker can arbitrarily assign themselves the administrator role within the system. This action grants them full control over user accounts, roles, and applications connected to smart-sso. Beyond privilege escalation, the vulnerability enables attackers to reset passwords for other users, effectively locking out legitimate administrators or impersonating them. Furthermore, the ability to manage integrated systems means that an attacker can disrupt service availability by deleting critical configurations or manipulate data integrity across all dependent services linked through this single sign-on solution.
From a classification perspective, this issue aligns with CWE-285 Improper Authorization and CWE-732 Incorrect Permission Assignment for Critical Resource. The failure to restrict access based on user roles constitutes a classic case of broken object level authorization where the system does not verify if the authenticated principal has permission to perform the requested action on the specific resource. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with MITRE ATT&CK T1078 Valid Accounts and T1098 Manipulated Credentials or Account Manipulation. Attackers leverage these capabilities to establish persistence within the environment by creating backdoor administrative accounts or modifying existing ones to ensure continued access even if initial credentials are compromised.
Mitigation strategies must prioritize immediate remediation of the underlying code logic alongside broader security hardening measures. The primary fix involves updating smart-sso to a version where 2.0.1 is no longer supported, ensuring that the PermissionFilter implements an explicit deny-by-default policy for all admin console paths unless they are explicitly whitelisted with appropriate role-based access controls. Developers should review the authentication and authorization middleware to ensure that every administrative endpoint requires verification of specific high-privilege roles before processing requests. Additionally, implementing robust input validation on parameters passed to endpoints like /admin/user-role/save can prevent manipulation attempts even if other layers fail. Organizations relying on this software should also enforce multi-factor authentication for all administrative accounts and monitor logs for unusual patterns such as rapid role changes or password resets initiated by non-administrative users to detect potential exploitation in real-time.