Admin.Core CVE-2026-111355

Requires an authenticated account that holds user-module or organization-module permissions configured with a Dept or Self DataScope; the attacker then supplies out-of-scope record ids to the UserService/OrgService by-id methods (e.g. get, update, disable, delete). Exploitation is LIMITED by the need for valid credentials with those specific module permissions - it is not remote-unauthenticated - but is otherwise network-reachable, needs no user interaction, and works against default DataScope-restricted configurations because the by-id code path omits the scope check. Severity in practice depends on how freely Dept/Self-scoped user/org management rights are granted to lower-trust accounts.

This is a CWE-639 authorization bypass (IDOR) rated CVSS:4.0 5.3 (Medium). The provided 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates a network-reachable, low-complexity attack that nonetheless REQUIRES authentication (PR:L) - specifically an account already holding user or organization module permissions scoped to Dept or Self. The impact is uniformly Low across confidentiality, integrity, and availability because the abuse is confined to user/org records within the application rather than full system compromise. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no POC/exploit-code flag was supplied, so exploitation status is 'no public exploit identified at time of analysis' - though a detailed third-party technical write-up (hackmd) and exact vulnerable source lines are public, which materially lowers the barrier to developing an exploit. On balance this is a real but bounded privilege-escalation / horizontal-access issue for organizations running zhontai Admin.Core, not a mass-exploitation emergency: it needs a valid low-privilege insider or compromised scoped account, and the affected product has a niche footprint. Treat as a medium-priority patch, higher if the deployment grants Dept/Self-scoped accounts to semi-trusted users.

A low-privileged user whose account is restricted to a Dept or Self DataScope, but who holds user- or organization-module permissions, enumerates record ids belonging to other departments and calls the UserService/OrgService by-id endpoints with those out-of-scope ids. Because the DataScope filter is not enforced on the by-id path, the attacker can read, modify, disable, or delete users outside their authorized department. No public exploit code is identified, but a public write-up pinpoints the exact vulnerable methods.