cool-admin-midway EUVD-2026-102506

Requires a valid authenticated admin account holding sys:user:* permissions (the department-limited/role-scoped admin tier) in cool-admin-midway up to and including 8.0.0. The flaw is that the base CRUD user service (sys/user.ts info/update/delete paths) accepts an arbitrary user id without enforcing that the target belongs to the caller's department, so exploitation needs only such a scoped account and a crafted request to /admin/sys/user/info, /admin/sys/user/update, or /admin/sys/user/delete. LIMITING FACTORS: not exploitable by anonymous/unauthenticated users - the attacker must already possess a provisioned admin account with user-management permission; impact is confined to the user-management module, and environments that do not use multi-department/role-scoped admins have little to escalate to.

This is a genuine, actionable privilege/scope-escalation issue but not a 'drop everything' internet-wide crisis. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 8.6 and is internally consistent with the description: an authenticated department-scoped admin (PR:H/L - a provisioned account) can remotely and without user interaction read, modify, and delete any user record. No EPSS score, no CISA KEV listing, and no explicit POC/exploit-code flag were provided in the input, so there is no signal of active or widespread exploitation; the risk is driven entirely by technical impact rather than exploitation pressure. A detailed public technical write-up (hieuPenguinnn HackMD) and the exact vulnerable source lines (user.ts L41-70 and L205-229) are referenced, which materially lowers the bar to weaponization even though no packaged exploit is listed. The key limiting factor the CVSS captures as PR:H is the real risk governor: an attacker must already hold a valid admin account with sys:user:* permissions, so this is primarily an insider / compromised-lower-tier-admin escalation rather than an anonymous remote takeover. SSVC-style read: exploitation = none observed, automatable = partial (simple IDOR, scriptable once authenticated), technical impact = total over the user table. Net: a real, high-value finding for anyone running cool-admin-midway with multi-tenant/department admin roles, but overall real-world urgency is tempered by low deployment footprint and the authentication prerequisite.

A department-limited administrator (or an attacker who has phished/compromised such a scoped admin account) sends authenticated requests to /admin/sys/user/info, /update, or /delete supplying user IDs belonging to other departments. Because the base CRUD service does not verify department ownership, the server returns and mutates those out-of-scope records, letting the attacker reset the passwords and roles of higher-privileged users (enabling full takeover) or delete accounts. A step-by-step technical write-up and the exact vulnerable code are publicly referenced, but no packaged exploit tool is listed.