Is there a public PoC exploit available for CVE-2026-16450?

Yes, a public proof-of-concept exploit is available for CVE-2026-16450. Prioritise patching immediately. EPSS: 0.4%.

ZS-Admin CVE-2026-16450

Q: What is the CVSS score of CVE-2026-16450?

CVE-2026-16450 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-46283 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-21 VulDB

GHSA-xgfr-74fv-qv4q

Authentication Bypass Zs Admin Zsadmin2025

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires a valid low-privilege session; impact is limited to reading cross-tenant department listings with no integrity, availability, or scope-change effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 16:30 vuln.today

Severity Changed

Jul 21, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Jul 21, 2026 - 16:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Jul 21, 2026 - 15:30 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization bypass. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Authorization bypass in ZS-Admin's multi-tenant API layer allows authenticated remote attackers to read department listing data belonging to other tenants by supplying an arbitrary value in the X-Tenant-Id HTTP header against the /api/system/sys/dept/page endpoint. The root cause is the getTenantId function of the MyBatis-Plus Tenant Plugin trusting a client-controlled header rather than deriving tenant scope from the authenticated session server-side. A public proof-of-concept is available via GitHub issue #5; no vendor patch or acknowledgment has been issued and the project has not responded to the disclosure.

Technical ContextAI

ZS-Admin is a Java-based administrative platform integrating MyBatis-Plus, a widely used ORM enhancement for the MyBatis SQL mapper framework. MyBatis-Plus includes a Tenant Plugin designed to enforce multi-tenant data isolation by automatically injecting tenant-scoped WHERE clauses into SQL queries. The vulnerable getTenantId function sources the tenant identifier directly from the client-supplied X-Tenant-Id HTTP request header, passing it to the plugin without validating that the authenticated user's session is authorized for that tenant. CWE-639 (Authorization Bypass Through User-Controlled Key) precisely describes this class: the application uses an attacker-controllable key as the sole authorization boundary for a security-sensitive operation. The CPE cpe:2.3:a:zsadmin2025:zs-admin:*:*:*:*:*:*:*:* covers all versions up to commit b52e14536d59fda11e56e2536a1c32e82a38cead.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project had not responded to the disclosure as of the report date. Monitor https://github.com/zsadmin2025/zs-admin-java/issues/5 and https://vuldb.com/vuln/380829 for patch availability. As an immediate compensating control, the getTenantId function should be patched locally to derive the tenant identifier exclusively from the server-side authenticated session context rather than from any client-supplied header - this eliminates the root cause entirely. As a secondary network-layer control, a WAF rule that strips or rejects X-Tenant-Id header values that do not match the value bound to the authenticated session token can reduce exploitation risk without requiring code changes, though it introduces dependency on session-to-header correlation logic at the WAF layer. Additionally, restricting the /api/system/sys/dept/page endpoint to internal networks or IP allowlists reduces exposure to external attackers but does not protect against insider threat or compromised low-privilege accounts.