CVE-2026-108923: 1024-lab smart-admin Support Config Query queryByKey access control
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
1024-lab smart-admin versions up to 3.30.0 are identified as affected. The issue is associated with the Support Config Query endpoint at /support/config/queryByKey.
What does an attacker need to exploit this issue?
The attack can be performed remotely by manipulating the configKey argument. The supplied severity vector indicates that low privileges are required and no user interaction is needed.
How likely is exploitation?
A public exploit disclosure exists and may be used. The provided exploit maturity rating is proof-of-concept.
Is a vendor fix available?
The available information does not identify a fixed version or a vendor remediation. It states that the project was notified through an issue report but had not responded.