SmartAdmin missing authorization lets users disable login protections
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
SmartAdmin through 3.30.0 has a missing authorization check (CWE-862) in AdminProtectController. An authenticated employee with low privileges can change system-wide level-3 protection settings, disabling login lockout and two-factor login, weakening password rules, and clearing lockout records.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for SmartAdmin.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Timeline
- 2026-10-13 Threatist record created from CVE-2026-110117
- 2026-10-13 Alias added: GHSA-5mw6-hjmc-5xjc
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: LOW → MEDIUM
References
Other 2
- https://github.com/1024-lab/smart-admin/blob/v3.30.0/smart-admin-api-java17-springboot3/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminProtectController.java#L55-L65
- https://github.com/1024-lab/smart-admin/blob/v3.30.0/smart-admin-api-java17-springboot3/sa-admin/src/main/java/net/lab1024/sa/admin/interceptor/AdminInterceptor.java#L84-L96
More 1024-lab vulnerabilities
- TI-2026-06564 1024-lab smart-admin Demo Site index.html access control CVSS 4.0MEDIUM 6.9
- TI-2026-71261 Improper access control in 1024-lab smart-admin support config query CVSS 4.0MEDIUM 5.3
- TI-2026-03215 1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java… CVSS 4.0MEDIUM 5.3
- TI-2026-03211 1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting CVSS 4.0MEDIUM 5.1
- TI-2026-03210 1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scripting CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-110117 · CVE Program
- CVE-2026-110117 · NVD
- FIRST EPSS
- GHSA-5mw6-hjmc-5xjc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences