CVE-2026-16450
Received Received - Intake

Authorization Bypass in ZS-Admin via X-Tenant-Id Header

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulDB

Description
A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization bypass. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-16450
EUVD
EUVD-2026-46283

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zsadmin2025 zs-admin to 1.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-tenant authorization bypass in the ZS-Admin application. It occurs because the application reads the tenant ID from the client-controlled X-Tenant-Id header instead of the authenticated user's session. This allows an attacker with a valid account in one tenant to forge the header and access or modify data belonging to another tenant.

Detection Guidance

To detect this vulnerability, check if the application improperly handles the X-Tenant-Id header. Send a request with a valid session for tenant A but set X-Tenant-Id to tenant B. If the response contains data from tenant B or SQL logs show tenant_id=2, the bypass is confirmed. Use tools like curl to test: curl -H 'X-Tenant-Id: tenant2' -H 'Cookie: session=valid_session_for_tenant1' http://target/api/system/sys/dept/page

Inspect SQL query logs for tenant_id conditions. If tenant isolation is bypassed, the logs will show unexpected tenant IDs in queries.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data across tenant boundaries. Attackers could view, modify, or delete data belonging to other tenants, potentially leading to data breaches, compliance violations, or unauthorized actions within the application.

Compliance Impact

This vulnerability could lead to violations of GDPR, HIPAA, and other data protection regulations by enabling unauthorized access to sensitive personal or health data across tenant boundaries. Compliance requires strict tenant isolation, which this flaw undermines.

Mitigation Strategies

Immediately validate the X-Tenant-Id header against the authenticated user's tenant ID. Reject requests where they do not match. Ensure tenant switching is restricted to platform administrators with server-side permission checks. Update the application to derive tenant ID from the session (e.g., LoginUserInfo) instead of the header.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16450. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart