CVE-2026-111366: cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user: permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.
Affected Software
Event History
Frequently Asked Questions
Which administrators are exposed to this issue?
Department-limited administrators are affected if they hold sys:user:* permissions. They can target user accounts outside the departments to which they are normally limited.
What does an attacker need to exploit the bypass?
The attacker needs an authenticated administrator account with sys:user:* permissions and the ability to supply arbitrary user IDs to the affected endpoints. No user interaction is required.
What actions can exploitation enable?
An attacker can read user records, update users outside their department, reset passwords or modify roles, and delete accounts through /admin/sys/user/info, update, or delete.