CVE-2026-111355

Received Received - Intake

Authorization Bypass in zhontai Admin.Core

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111355

Affected Vendors & Products

Vendor	Product	Version / Range
zhontai	Admin.Core	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

zhontai Admin.Core through version 10.1.0 has an authorization bypass flaw. Authenticated users can bypass department DataScope restrictions by providing record IDs outside their scope. This allows attackers with user or organization module permissions to read, modify, disable, or delete users in other departments.

Impact Analysis

If you are an authenticated user with permissions in the user or organization modules, an attacker could exploit this to access or alter data belonging to other departments. This could lead to unauthorized data exposure, modification, or deletion of sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update zhontai Admin.Core to the latest version beyond 10.1.0 to address the authorization bypass flaw. Review and restrict user permissions to prevent unauthorized access to UserService and OrgService methods. Implement strict DataScope validation to ensure users can only access records within their designated scope.

Hi! I’m here to help you understand CVE-2026-111355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70