CVE-2026-16217
Received Received - Intake

Authorization Bypass in guohongze adminset via project_id

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: VulDB

Description
A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the argument project_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-19
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-16217
EUVD
EUVD-2026-45428

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
guohongze adminset to 0.61 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in guohongze adminset up to 0.61. It affects the delivery deployment endpoint in the file delivery/deli.py. The issue allows manipulation of the project_id argument to bypass authorization checks, enabling unauthorized deployments by low-privileged users.

Detection Guidance

Check for unauthorized deployment attempts by monitoring logs in /var/opt/adminset/logs/adminset-error.log for suspicious project_id manipulations. Inspect network traffic for requests to delivery/deli.py with varying project_id values from low-privileged users.

Impact Analysis

An attacker could exploit this to deploy unauthorized projects, potentially causing service disruptions or rolling out malicious code. Since the exploit is public, any user with access to the deployment URL could manipulate project_id to deploy projects they are not authorized to access.

Compliance Impact

This vulnerability allows unauthorized users to bypass authorization checks and trigger deployments for projects they do not have access to. For compliance with GDPR, this could lead to unauthorized data processing or exposure if project deployments involve handling personal data. Under HIPAA, unauthorized deployments might compromise protected health information if the system manages healthcare-related projects.

Mitigation Strategies

Implement project membership checks in the delivery deployment endpoint to verify user authorization before allowing deployments. Restrict access to the deployment URL to only authorized users and disable debug mode in production.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart