EUVD-2026-45428
GHSA-hw85-f2hq-fxjx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible IDOR requires authenticated low-privilege user; no scope change; no availability impact described in the flaw.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the argument project_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Authorization bypass in guohongze adminset 0.61 and earlier allows authenticated remote attackers to access or manipulate deployment resources belonging to other projects by substituting arbitrary project_id values in requests to the Delivery Deployment Endpoint (delivery/deli.py). This CWE-639 flaw - Authorization Bypass Through User-Controlled Key - is a classic IDOR pattern where the application accepts user-supplied object identifiers without verifying ownership. A public proof-of-concept exploit is available via GitHub issue #161, and the vendor has not responded to the responsible disclosure; no patch exists at time of analysis.
Technical ContextAI
adminset is an open-source Python-based IT automation and CMDB (Configuration Management Database) platform by guohongze, used for managing infrastructure, deployments, and configuration across projects. The vulnerability resides in delivery/deli.py, which implements the Delivery Deployment Endpoint responsible for triggering or managing deployment jobs. CWE-639 (Authorization Bypass Through User-Controlled Key) describes a flaw where the application uses a user-supplied key - here, the project_id parameter - as the sole access control gatekeeper without verifying that the authenticated principal is authorized to act on the referenced object. In practice, this is an Insecure Direct Object Reference (IDOR): project identifiers are likely sequential integers or guessable strings, enabling enumeration. CPE cpe:2.3:a:guohongze:adminset:*:*:*:*:*:*:*:* covers all tracked versions through 0.61 with no platform restriction.
RemediationAI
No vendor-released patch has been identified at time of analysis - the adminset project was notified via GitHub issue report but has not responded. Administrators should immediately restrict network access to the Delivery Deployment Endpoint so that only explicitly authorized users and CICD systems can reach it, using firewall rules or reverse-proxy ACLs to enforce this boundary. If adminset is deployed in a multi-project or multi-team environment, consider disabling or blocking the /delivery/ endpoint at the network perimeter until a fix is released - the trade-off is loss of automated deployment triggering via that endpoint, which can be replaced temporarily with direct SSH-based or CLI-based deployments. Audit existing deployment logs for anomalous project_id values in requests from accounts that do not own those projects. Do not expose adminset's web interface to the public internet until this is resolved. Monitor https://github.com/guohongze/adminset/issues/161 and https://vuldb.com/vuln/380040 for patch announcements.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today