EUVD-2026-78624
GHSA-qh9f-8qc2-5365
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote low-complexity broken-authZ on a query endpoint primarily leaks config (C:H); 'escalate privileges' implies an existing foothold so PR:L, with only secondary integrity (I:L) and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.
AnalysisAI
An authorization bypass in the SmartAdmin (1024-lab/smart-admin) v3.30.0 configuration query endpoint allows a remote attacker to read configuration data they are not entitled to access and to escalate privileges within the application. The vendor scores this as maximum severity (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating that realistic exploitation likely requires an existing low-privilege session and that the dominant impact is disclosure of sensitive configuration content rather than full system takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the SmartAdmin (1024-lab/smart-admin) v3.30.0 configuration query endpoint, which fails to properly enforce authorization (CWE-863). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) frames this as a maximum-severity unauthenticated remote flaw, but the signals do not reinforce that severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the available data at time of analysis, so defenders should not rely on a version upgrade until the upstream project publishes a fixed release; check https://github.com/1024-lab/smart-admin and the advisory at https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-88617.md for a fix commit or patched tag. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of SmartAdmin v3.30.0 and restrict network access to the configuration query endpoint to trusted IP addresses only; review application logs for any unauthorized access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Smartadmin
View allSmartAdmin versions up to 3.29 contain a template injection vulnerability in the FreeMarker template handler that allows
A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the fi
A weakness has been identified in 1024-lab/lab1024 SmartAdmin versions up to 3.29. is affected by cross-site scripting (
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today