CVE-2026-16450 in ZS-Admin
Summary
by MITRE • 07/21/2026
A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization bypass. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability resides within the zsadmin2025 ZS-Admin application where the getTenantId function in the MyBatis-Plus Tenant Plugin component fails to properly validate or sanitize the X-Tenant-Id HTTP header parameter. The flaw specifically manifests in the /api/system/sys/dept/page endpoint, which processes tenant identification information for multi-tenant database operations. When an attacker manipulates the X-Tenant-Id argument, they can potentially bypass authorization mechanisms that should restrict access to specific tenant data, allowing cross-tenant data access and manipulation. This represents a critical security weakness that directly impacts the application's multi-tenancy model and data isolation principles.
The technical exploitation of this vulnerability follows the pattern of parameter tampering within HTTP headers, where attackers can manipulate the X-Tenant-Id value to assume the identity of different tenants within the system. This type of flaw commonly maps to CWE-285: Improper Authorization, which occurs when a system fails to properly enforce access controls for authenticated users. The vulnerability's remote attack surface means that malicious actors do not require physical access or local network privileges to exploit this weakness, making it particularly dangerous in cloud environments where applications are exposed to public networks.
The operational impact of this authorization bypass could be severe for organizations relying on the zsadmin2025 platform for multi-tenant operations. Unauthorized users might gain access to sensitive data belonging to other tenants, potentially leading to data breaches, compliance violations, and financial losses. The rolling release system employed by this project complicates remediation efforts as version information is not publicly disclosed, making it difficult for administrators to determine whether their installations are vulnerable or patched. This lack of transparency in release management creates challenges for security teams trying to assess risk and implement appropriate controls.
Security mitigations should include immediate validation and sanitization of the X-Tenant-Id parameter within the getTenantId function, implementing strict input validation that ensures tenant identifiers match expected patterns and authorized values. Organizations should also consider implementing additional authorization checks beyond the initial tenant identification, such as role-based access controls that verify user permissions for specific tenant resources. The vulnerability aligns with ATT&CK technique T1078: Valid Accounts, where adversaries leverage legitimate credentials to gain access to systems, though in this case the weakness lies in improper authorization rather than compromised accounts. Organizations should also implement network-level controls including firewall rules and API gateways that can monitor and filter suspicious header values, while conducting thorough penetration testing to identify similar parameter manipulation vulnerabilities across other endpoints.
The lack of response from the project maintainers following early issue reporting creates additional risk for affected organizations, as they may be left without official patches or guidance for addressing this critical flaw. This delay in vendor response increases the window of opportunity for attackers who may already have access to public exploits, potentially leading to widespread exploitation across installations using vulnerable versions of the software. Security teams should consider implementing compensating controls such as network segmentation, monitoring for unusual header patterns, and regular security assessments of third-party components to identify similar authorization bypass vulnerabilities in other applications within their infrastructure.