CVE-2026-88620: SmartAdmin API Java17 SpringBoot3 vulnerability
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated employee with low privileges can exploit it. The issue affects access to the /employee/queryAll endpoint when the required function-level permission and data-scope checks are not enforced.
What information can an attacker access?
A low-privileged authenticated employee may retrieve employee records for users and departments outside their authorized scope.
Does exploitation require authentication?
Yes. The described attacker must be authenticated as an employee; no unauthenticated access is described.