Executive Summary

CVE-2026-1196 is an information disclosure vulnerability in MineAdmin versions 1.x and 2.x, specifically in the /system/getFileInfoById endpoint. By manipulating the file ID parameter, an attacker can enumerate file IDs and read sensitive file information such as file hashes without authorization. Using these hashes, the attacker can preview or download files through other endpoints, leading to unauthorized disclosure of sensitive data. The vulnerability can be exploited remotely but requires a high level of complexity and privileges. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive files and data stored in the MineAdmin system. Attackers can remotely access and download confidential information without proper authorization, potentially compromising data confidentiality and security. Since there are no known mitigations or patches and the vendor has not responded, affected users remain at risk until they replace or secure the system. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring and testing the /system/getFileInfoById endpoint for unauthorized access attempts using manipulated ID parameters. Since the vulnerability involves enumeration of file IDs to read file information, you can use HTTP request tools like curl or specialized vulnerability scanners to send requests with varying ID values to see if sensitive file information is disclosed. For example, a command like `curl -v http://<target>/system/getFileInfoById?id=1` and incrementing the ID value can help detect if unauthorized file info is accessible. Additionally, monitoring network traffic for unusual requests to this endpoint or unexpected file hash retrievals can help detect exploitation attempts. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

There are no known patches or vendor-provided mitigations for this vulnerability as the vendor did not respond to the disclosure. Immediate mitigation steps include restricting access to the affected endpoint /system/getFileInfoById by implementing network-level controls such as firewall rules or access control lists to limit who can reach this endpoint. Consider disabling or restricting the use of the affected API if possible. Monitoring for exploitation attempts and preparing to replace the affected MineAdmin product with an alternative solution are also recommended due to the lack of fixes. [2]

Useful 0 Not Useful 0