CVE-2026-111355
zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.
| CWE | CWE-639 |
| Vendor | zhontai |
| Product | admin.core |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for zhontai admin.core
Be the first to know when new medium vulnerabilities affecting zhontai admin.core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
zhontai / Admin.Core
0 ≤ 10.1.0
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/zhontai-admin-core-by-id-missing-data-scope-cross-dept github.com: https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L118-L144 github.com: https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L595-L636 github.com: https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L887-L900 github.com: https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L977-L1000 github.com: https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/Org/OrgService.cs#L64-L68 vulncheck.com: https://www.vulncheck.com/advisories/zhontai-admin-core-through-10.1.0-authorization-bypass-via-user-and-organization-by-id-endpoints
Credits
hieuPenguinnn