CVE-2026-110105
Received Received - Intake

B3log Symphony Missing Authorization in Admin Routes

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-110105
EUVD
EUVD-2026-98938

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
b3log Symphony 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

B3log Symphony through 3.6.4 has a missing authorization vulnerability where PermissionMidware.check allows unauthenticated users to access admin routes that lack permission.rule.url entries. Attackers can exploit this to reach endpoints like /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point without proper permissions.

Detection Guidance

Check web server access logs for suspicious requests to admin routes like /admin/report/ignore/, /admin/tags/remove-unused, or /admin/user//init-point. Look for unauthenticated HTTP GET or POST requests to these paths.

Impact Analysis

An attacker could exploit this to ignore reports, delete unused tags, or grant points without audit logging. This could lead to unauthorized changes in the system, data loss, or manipulation of user points, potentially disrupting normal operations.

Compliance Impact

This vulnerability could violate compliance requirements that mandate audit logging and access controls, such as GDPR's accountability principle or HIPAA's audit control standard. Unauthorized actions may go undetected, leading to potential non-compliance penalties.

Mitigation Strategies

Update B3log Symphony to the latest version beyond 3.6.4. If an update is not immediately available, restrict access to admin routes via web server configuration or firewall rules to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110105. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart