Vulnerabilities

TI-2026-72001 CVE-2026-110117 · GHSA-5mw6-hjmc-5xjc

SmartAdmin missing authorization lets users disable login protections

MEDIUM 64

SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00277 Published 2026-10-13 No fix listed CWE-862

TI-2026-71261 CVE-2026-108923 · GHSA-wwvh-6vc7-p2p2

Improper access control in 1024-lab smart-admin support config query

MEDIUM 57

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00209 Published 2026-10-12 No fix listed CWE-266

TI-2026-06564 CVE-2026-7468 · GHSA-m623-j3j4-q8vr

1024-lab smart-admin Demo Site index.html access control

HIGH 70

A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00356 Published 2026-04-30 No fix listed CWE-266

TI-2026-03215 CVE-2026-3725 · GHSA-3vhr-rrhf-p2mj

1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java…

MEDIUM 57

A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00452 Published 2026-03-08 No fix listed CWE-1336

TI-2026-03211 CVE-2026-3721 · GHSA-w9x3-7q6f-79x9

1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting

MEDIUM 56

A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00306 Published 2026-03-08 No fix listed CWE-79

TI-2026-03210 CVE-2026-3720 · GHSA-ghxx-f98c-rf6v

1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scripting