CVE-2026-110117: SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated SmartAdmin employee account with low privileges can exploit it. No user interaction is required.
What access is needed to change the affected protections?
An attacker needs a valid authenticated employee session and network access to the SmartAdmin application. The affected updateConfig and loginFail batchDelete endpoints lack the authorization protection needed to restrict these actions to appropriate administrators.
Which security controls can be altered or bypassed?
An attacker can disable login lockout and two-factor login, weaken password rules, and clear login-lockout records. These changes affect system-wide level-3 protection settings.
Are deployments using version 3.30.0 affected?
Yes. The issue is reported in SmartAdmin through version 3.30.0; version 3.30.0 is therefore within the affected range.