CVE-2026-111355: zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this bypass?
Authenticated users who hold permissions for the user or organization modules and are assigned Dept or Self data scope are affected. They can target records outside their authorized department by supplying out-of-scope record IDs.
What actions can an attacker perform through the affected endpoints?
An attacker can use UserService and OrgService by-ID methods to read, modify, disable, or delete users in other departments.
How can defenders identify possible exploitation?
Review calls to UserService and OrgService by-ID methods for record IDs belonging to departments outside the caller's permitted Dept or Self scope. Actions affecting cross-department user records, including reads, updates, disables, or deletions, are relevant indicators.