CVE-2026-111365

Received Received - Intake

Authorization Bypass in Cool-Admin-Midway

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111365

Affected Vendors & Products

Vendor	Product	Version / Range
cool-team-official	cool-admin-midway	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

cool-admin-midway through version 8.0.0 has an authorization bypass flaw. Non-superadmin users with admin privileges can exploit this to read, modify, or delete roles of other admins by providing arbitrary role IDs. This allows attackers with basic sys:role permissions to call specific endpoints like /admin/sys/role/info, update, or delete with another admin's role ID, enabling them to rewrite menu and department grants and alter other users' access.

Impact Analysis

This vulnerability allows attackers to escalate their privileges by modifying other admins' roles, potentially gaining unauthorized access to sensitive functions or data. It could lead to unauthorized modifications of system configurations, data breaches, or complete system compromise if exploited successfully.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using this software may face compliance violations, legal penalties, and reputational damage due to potential data breaches or unauthorized access to protected health or personal information.

Mitigation Strategies

Upgrade cool-admin-midway to version 8.0.1 or later to address the authorization bypass vulnerability. Review and restrict access to /admin/sys/role/info, update, and delete endpoints to prevent unauthorized role modifications.

Hi! I’m here to help you understand CVE-2026-111365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70