CVE-2026-110105 — B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits r…
Published: 2026-10-13 · CVSS: 6.9 · CVSS 4.0
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7