CVE-2026-110105: B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or administrator privileges?
No. The affected admin routes can be reached by unauthenticated attackers because routes without permission.rule.url entries are permitted by the authorization middleware.
What capabilities can an attacker gain through the exposed routes?
An attacker can ignore a report through /admin/report/ignore/{reportId}, delete unused tags through /admin/tags/remove-unused, or grant points to a user through /admin/user/{userId}/init-point.
Can misuse of these routes be identified from audit logs?
No. The described actions can be performed without audit logging, so audit records will not reliably show abuse of these endpoints.
Which deployments are within the stated affected range?
B3log Symphony versions through 3.6.4 are identified as affected. The vulnerability is reachable over the network and does not require user interaction.