CVE-2026-88619: SmartAdmin vulnerability
1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality intended for authorized administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged authenticated user can exploit it. The issue affects access to scheduled-job management functionality that is intended for authorized administrators.
What access does an attacker need before exploiting it?
The attacker needs a valid authenticated account with low privileges. The provided information does not indicate that unauthenticated access is possible.
Which component should be prioritized for review?
Prioritize the scheduled-job management module, specifically endpoints exposed by AdminSmartJobController. These endpoints lack method-level permission checks.