Missing Authorization in SmartAdmin v3.30.0 Job Module

Executive Summary

CVE-2026-88619 is a missing authorization vulnerability in 1024-lab SmartAdmin v3.30.0. The AdminSmartJobController lacks method-level permission checks, allowing low-privileged authenticated users to access scheduled-job management functions meant for administrators.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the AdminSmartJobController endpoints by reviewing logs for requests to scheduled-job management functions. Look for low-privileged users performing administrative actions like job creation, modification, or execution. Verify if Sa-Token annotations are missing on these endpoints compared to other controllers.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a low-privileged account could perform unauthorized administrative actions like reading job logs, executing jobs, creating or modifying job configurations, or disabling jobs. This could lead to system disruption, data leaks, or further compromise of the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive job data or system functions. GDPR may be impacted if personal data is exposed through job execution. HIPAA could be affected if protected health information is compromised via unauthorized job operations.

Useful 0 Not Useful 0

Mitigation Strategies

Implement explicit permission checks for all scheduled-job operations in AdminSmartJobController. Add method-level permissions using Sa-Token annotations or AdminInterceptor. Separate privileges for read, execute, create, modify, and delete actions. Validate job IDs and implementations to ensure users can only access permitted jobs.

Useful 0 Not Useful 0