CVE-2026-111723: LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authorityid, and delete accounts.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need before exploiting this issue?
The attacker only needs a registered user account. They can self-register and then use the affected API despite not being an administrator.
What could an attacker do after exploiting the vulnerable API?
An attacker can manage all accounts, including reading every account's bcrypt password hash, resetting the bootstrap administrator password, increasing authority_id values, and deleting accounts.
How can defenders determine whether their deployment is affected?
Deployments at or through commit 8a6924a are identified as affected. Defenders should examine access to /admin/v1/admins for requests made with non-administrator registered-user credentials and review account changes such as password resets, authority_id increases, or deletions.