CVE-2026-111366

Received Received - Intake

Authorization Bypass in Cool Admin Midway Allows Unauthorized User Management

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111366

Affected Vendors & Products

Vendor	Product	Version / Range
cool-team-official	cool-admin-midway	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

cool-admin-midway versions up to 8.0.0 have an authorization bypass flaw. Department-limited admins with sys:user:* permissions can manage users outside their departments by providing arbitrary user IDs. This allows them to call endpoints like /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

Impact Analysis

Attackers with sys:user:* permissions could escalate privileges, access sensitive user data, modify roles or passwords, or delete accounts. This could lead to unauthorized access, data breaches, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, violating GDPR's data protection principles and HIPAA's security rules. Organizations may face fines, legal penalties, and reputational damage due to non-compliance.

Mitigation Strategies

Immediately restrict sys:user:* permissions to prevent unauthorized access. Review and update authorization policies to enforce strict department-based access controls. Disable or restrict access to endpoints like /admin/sys/user/info, update, and delete until patches are applied.

Hi! I’m here to help you understand CVE-2026-111366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70