Executive Summary

CVE-2026-1194 is an information disclosure vulnerability in MineAdmin versions 1.x and 2.x, specifically in the Swagger component. Due to improper permission validation in the default deployment configuration, an attacker can remotely access sensitive Swagger API documentation by sending a GET request to the endpoint `/swagger/http.json`. This exposes internal API details and system information without requiring authentication, potentially aiding attackers in gathering information about the system. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive internal API information, which may allow attackers to gather detailed information about the backend system. Such information leakage can facilitate further attacks by revealing system structure, endpoints, and potentially sensitive data. Since the vulnerability is remotely exploitable without authentication and a public exploit exists, it poses a moderate security risk. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Swagger API documentation endpoint is accessible without authentication. Specifically, sending a GET request to the endpoint `/swagger/http.json` on the MineAdmin server can reveal if sensitive information is exposed. For example, you can use the following command to test this: `curl -v http://<target-ip-or-domain>/swagger/http.json`. If the response contains Swagger API documentation data without requiring authentication, the system is vulnerable. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include strengthening permission validation controls on the Swagger interface to prevent unauthorized access. Since the vulnerability arises from the default deployment configuration exposing Swagger documentation without authentication, restricting access to the Swagger endpoint (e.g., via authentication, IP whitelisting, or disabling Swagger in production) is recommended. If no patch or fix is available from the vendor, consider replacing the affected product with an alternative or disabling the Swagger interface until a secure configuration is ensured. [1, 2]

Useful 0 Not Useful 0