| शीर्षक | zsadmin ZS-Admin <=1.0.0 Authorization Bypass |
|---|
| विवरण | ZS-Admin uses the MyBatis-Plus tenant plugin for field-level multi-tenant isolation. The tenant context should be derived from a trusted server-side authentication context, such as the authenticated user's tenantId. However, the current implementation reads the tenant ID directly from the client-controlled X-Tenant-Id request header and stores it in TenantContext.
MultiTenantHandler later reads this value from TenantContext and injects it into SQL tenant conditions. The application does not compare the supplied tenant ID with the tenant ID stored in the authenticated user's LoginUserInfo. Therefore, a user from tenant 1 can change the request header to tenant 2, causing the generated SQL condition to become tenant_id = 2. |
|---|
| स्रोत | ⚠️ https://github.com/zsadmin2025/zs-admin-java/issues/5 |
|---|
| उपयोगकर्ता | cl0ney (UID 99026) |
|---|
| सबमिशन | 15/06/2026 05:48 PM (1 महीना पहले) |
|---|
| संयम | 21/07/2026 10:55 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 380829 [zsadmin2025 ZS-Admin तक b52e14536d59fda11e56e2536a1c32e82a38cead MyBatis-Plus Tenant Plugin page getTenantId X-Tenant-Id अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|