CVE-2026-108923
Received Received - Intake

Improper Access Control in 1024-lab Smart-Admin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108923
EUVD
EUVD-2026-97783

Affected Vendors & Products

Showing 31 associated CPEs
Vendor Product Version / Range
1024-lab smart-admin 3.0
1024-lab smart-admin 3.1
1024-lab smart-admin 3.2
1024-lab smart-admin 3.3
1024-lab smart-admin 3.4
1024-lab smart-admin 3.5
1024-lab smart-admin 3.6
1024-lab smart-admin 3.7
1024-lab smart-admin 3.8
1024-lab smart-admin 3.9
1024-lab smart-admin 3.10
1024-lab smart-admin 3.11
1024-lab smart-admin 3.12
1024-lab smart-admin 3.13
1024-lab smart-admin 3.14
1024-lab smart-admin 3.15
1024-lab smart-admin 3.16
1024-lab smart-admin 3.17
1024-lab smart-admin 3.18
1024-lab smart-admin 3.19
1024-lab smart-admin 3.20
1024-lab smart-admin 3.21
1024-lab smart-admin 3.22
1024-lab smart-admin 3.23
1024-lab smart-admin 3.24
1024-lab smart-admin 3.25
1024-lab smart-admin 3.26
1024-lab smart-admin 3.27
1024-lab smart-admin 3.28
1024-lab smart-admin 3.29
1024-lab smart-admin 3.30.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass flaw in the smart-admin system up to version 3.30.0. It allows low-privilege users to retrieve a universal plaintext password called 'super_password' by manipulating the 'configKey' argument in the /support/config/queryByKey endpoint. This password can then be used to log in as any user, including super administrators, bypassing password verification and two-factor authentication.

Detection Guidance

Check for unauthorized access to the /support/config/queryByKey endpoint. Monitor logs for requests querying the 'super_password' configuration key. Use tools like curl to test if the endpoint leaks sensitive data: curl -X GET 'http://<target>/support/config/queryByKey?configKey=super_password'

Inspect network traffic for unusual API calls to /support/config/queryByKey with low-privilege user tokens. Verify if any user accounts were accessed without proper authentication.

Impact Analysis

An attacker could gain full control over the smart-admin system by exploiting this flaw. This includes accessing sensitive data, performing unauthorized actions, and taking over admin accounts. The attack can be executed remotely with minimal privileges, making it highly dangerous for systems using affected versions.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive data, which could lead to breaches of GDPR's confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face regulatory penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the /support/config/queryByKey endpoint. Update to a patched version if available. Rotate the 'super_password' and all user passwords. Disable universal password functionality if present.

Implement strict input validation for the configKey parameter. Enforce role-based access control (RBAC) for all sensitive API endpoints. Monitor for any signs of exploitation or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart