CVE-2026-111365: cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated non-superadmin administrators with ordinary sys:role permissions can exploit it. They do not need superadmin privileges.
What does an attacker need to provide to access another administrator's role?
The attacker needs to supply the role ID belonging to another administrator when calling the role info, update, or delete functionality. The affected endpoints include /admin/sys/role/info and the role update and delete operations.
What access changes can result from successful exploitation?
An attacker can read, modify, or delete another administrator's role. By rewriting menu and department grants, they can change the effective access of other users.
Which versions are identified as affected?
cool-admin-midway through version 8.0.0 is identified as affected.