Authorization Bypass in SmartAdmin v3.30.0

Executive Summary

CVE-2026-88617 is an authorization flaw in SmartAdmin v3.30.0 where the super_password configuration value is exposed to low-privileged authenticated employees through the endpoint /support/config/queryByKey. This allows an attacker with knowledge of an administrator's login name to authenticate as that administrator.

Useful 0 Not Useful 0

Detection Guidance

Check if the endpoint /support/config/queryByKey is accessible without proper authorization. Use tools like curl to query the endpoint: curl -X GET http://<target>/support/config/queryByKey?key=super_password. If it returns the super_password value without requiring high privileges, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain administrator-level access by exploiting this vulnerability, potentially leading to unauthorized system control, data breaches, or further network compromise. The attack requires low-privileged employee access or knowledge of an administrator's login name.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). Organizations using SmartAdmin v3.30.0 may face regulatory penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict access to the /support/config/queryByKey endpoint to authorized administrators only. Remove the super_password configuration value and replace it with individual user authentication. Rotate the exposed super_password immediately if it was compromised. Ensure all login paths enforce email verification code checks.

Useful 0 Not Useful 0