SmartAdmin CVE-2026-110117

Requires a valid authenticated session as a low-privileged SmartAdmin employee (PR:L); exploitation then needs no special product configuration because the updateConfig and loginFail batchDelete endpoints in AdminProtectController ship without the authorization annotation enforced by AdminInterceptor, so default deployments through v3.30.0 are affected. The limiting factor is the account prerequisite: an attacker must first hold or obtain ordinary employee credentials and reach the admin API over the network; there is no unauthenticated path and no user interaction is required.

This is a genuine but moderate-priority issue rather than an urgent crisis. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the description agree: exploitation is network-reachable, low-complexity, requires no user interaction, but DOES require an authenticated low-privileged employee account (PR:L) - it is not a pre-auth remote flaw. Impact is confined to integrity (VI:H) with no confidentiality or availability loss, consistent with the described ability to alter security-protection settings rather than read or destroy data. The real danger is indirect: by disabling login lockout and two-factor login, weakening password rules, and clearing lockout records, an attacker degrades the controls that protect every other account, enabling follow-on credential attacks (e.g., brute force) that would otherwise be blocked. No EPSS score, CISA KEV listing, or public exploit code is present in the supplied data, so there is no evidence of active exploitation or automatable mass exploitation; the signals point to a plausible-but-not-yet-widely-weaponized vulnerability whose severity depends heavily on how easily low-privileged accounts can be obtained in a given deployment. Note the input Tag 'Authentication Bypass' is imprecise - the CWE-862 (Missing Authorization) classification and description describe a broken authorization check, not a bypass of authentication itself; verify categorization with the vendor/NVD.

A low-privileged employee (or an attacker who has phished or otherwise obtained ordinary employee credentials) logs into SmartAdmin and directly invokes the AdminProtectController updateConfig endpoint, which lacks an authorization annotation. They disable login lockout and two-factor login and weaken password complexity, then call loginFail batchDelete to erase lockout records - clearing the way for brute-force or password-spraying attacks against higher-privileged accounts. No public exploit code is identified in the provided data, though a HackMD technical writeup and a VulnCheck advisory document the endpoints involved.