SmartAdmin CVE-2026-108923

Exploitation requires a valid authenticated session with at least low-level privileges (CVSS PR:L) against an application built on 1024-lab smart-admin ≤3.30.0, specifically reaching the Support Config Query component's /support/config/queryByKey endpoint and manipulating the configKey argument. No user interaction or non-default configuration is indicated (UI:N, AC:L, AT:N), so any account that can reach the Support Config function is sufficient. Limiting factors: the attacker must already possess credentials (this is not unauthenticated), impact is confined to Low confidentiality/integrity/availability with no scope change, and exposure depends on the SmartAdmin-based deployment being network-reachable to the attacker.

This is a genuine but modest-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (MEDIUM) and indicates a network-reachable, low-complexity flaw that nonetheless requires some level of authentication (PR:L), so it is not a pre-auth remote compromise. CWE-284 (improper access control) combined with the endpoint name /support/config/queryByKey points to a broken-access-control / horizontal-or-vertical privilege issue where an authenticated low-privilege user can read configuration they should not reach. Exploitation signals are mixed: a public exploit/PoC is referenced (GitHub issue #137) and VulDB marks exploit maturity E:P (proof-of-concept), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of widespread or active exploitation - treat the PoC as available-but-not-confirmed-weaponized. The impacts in the input vector (VC:L/VI:L/VA:L) are each only Low and no scope change occurs (SC/SI/SA:N), consistent with limited data exposure rather than full system takeover. Note a conflict worth verifying: the input Tags label this 'Authentication Bypass,' but PR:L and CWE-284 describe access control abuse by an already-authenticated user, not an authentication bypass - verify the exact privilege boundary with the project. Net: a real low-to-medium access-control bug in a niche open-source product that the vendor has not yet acknowledged; schedule a fix but it does not warrant emergency response absent broader deployment or escalation evidence.

An authenticated low-privilege user of a SmartAdmin-based application sends a crafted request to /support/config/queryByKey, manipulating the configKey parameter to retrieve configuration entries that should be restricted to administrators. A public proof-of-concept tied to the project's GitHub issue tracker (issue #137) exists, lowering the effort to reproduce, though the low attack complexity is offset by the requirement for a valid account.