CVE-2026-110117 — SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level…
Published: 2026-10-13 · CVSS: 7.1 · CVSS 4.0
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7