Missing Authorization in LingGuo-Drama Allows Privilege Escalation

Executive Summary

CVE-2026-111723 is a missing authorization vulnerability in LingGuo-Drama where any registered user can manage all accounts via the /admin/v1/admins API. Attackers can self-register, read bcrypt password hashes of all users, reset the bootstrap admin's password, elevate their privileges, and delete accounts. The flaw stems from improper access control checks despite using AuthAdminJWT.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the /admin/v1/admins API endpoint. Look for unusual account management activities like password resets, privilege escalations, or account deletions. Monitor for GET requests to /admin/v1/admins that return bcrypt hashes or list all accounts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to take over all accounts, including administrative ones. They can access sensitive data like password hashes, reset passwords, escalate privileges, and delete accounts. Even low-privilege users can exploit this to gain full control of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive data (password hashes) and potential exposure of personal information. It undermines data protection requirements for access control and user consent.

Useful 0 Not Useful 0

Mitigation Strategies

Disable open registration or enforce admin approval. Implement strict role-based access control (RBAC) and validate ownership for all data access. Remove bcrypt hash exposure in API responses and enforce JWT validation on all admin endpoints.

Useful 0 Not Useful 0