LingGuo-Drama EUVD-2026-103015

Exploitation requires a deployment of LingGuo-Drama at commit 8a6924a or earlier with open self-registration, because the /admin/v1/admins API trusts any valid AuthAdminJWT without verifying the caller's authority level. The only prerequisite is holding a registered user token (PR:L), which the application lets attackers mint themselves via self-registration; no admin credentials, user interaction, or non-default configuration are needed, and the endpoint is reachable over the network. The practical limiting factor is simply whether registration is enabled and the host is network-accessible - there is no CSRF, MFA, or secondary authorization gate to overcome.

This is a genuine, high-priority access-control flaw rather than an inflated high-CVSS score. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H = 8.7) is internally consistent with the description: a network-reachable API, low complexity, and only low privileges (PR:L) needed - and because the application permits self-registration, that PR:L barrier is effectively self-service, collapsing the practical authentication requirement toward trivial. Impact is maximal across all three dimensions (confidentiality via exposure of every account's bcrypt hash, integrity via password/authority_id modification, availability via account deletion), which the CWE-862 (Missing Authorization) root cause supports. Countervailing signals temper absolute urgency: there is no CISA KEV listing, no EPSS score was supplied, and no public exploit code is referenced (the HackMD writeup documents the flaw but is not confirmed weaponized exploit code). The decisive mitigating factor is deployment footprint - LingGuo-Drama is an obscure open-source project with no evidence of broad production use - so despite the near-worst-case technical impact, real-world aggregate exposure is low. No signals directly conflict; the main gap is the absence of EPSS/KEV/POC data to gauge likelihood of mass exploitation.

An attacker self-registers a normal user account, obtaining an AuthAdminJWT token that the /admin/v1/admins endpoint accepts without any further authorization check. Using that token over the network, the attacker enumerates all admin accounts, issues a PUT to reset the bootstrap administrator's password and raise their own authority_id, and achieves full administrative control. No public exploit code is identified at time of analysis, though a detailed HackMD write-up documents the technique.