EUVD-2026-78624
GHSA-qh9f-8qc2-5365
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed SmartAdmin config endpoint
-
ExploitSend request bypassing authorization check
-
ExecutionRetrieve restricted configuration data
-
ImpactLeverage exposed secrets/roles to escalate privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the SmartAdmin (1024-lab/smart-admin) v3.30.0 configuration query endpoint, which fails to properly enforce authorization (CWE-863). The vendor vector marks it as unauthenticated (PR:N), but the described outcome - 'escalate privileges' - implies the attacker already holds some level of access that is then elevated, so realistic exploitation may require an existing low-privilege session or account. Primary limiting factors: the target must expose the vulnerable SmartAdmin instance to the attacker's network, run the affected v3.30.0, and the impact hinges on whether the exposed configuration contains sensitive secrets that enable further escalation. |
| Impact | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) frames this as a maximum-severity unauthenticated remote flaw, but the signals do not reinforce that severity. EPSS is only 0.22% (13th percentile), it is NOT in CISA KEV, and no exploit is marked available - so there is no evidence of widespread or active exploitation. The CWE-863 (incorrect authorization) classification and the description ('authorization flaw in the configuration query endpoint') point to a broken-access-control read on a config-query endpoint, which most naturally yields confidentiality impact (config/secret disclosure) rather than the full C:H/I:H/A:H triad the vector claims. The phrase 'escalate privileges' also conflicts with PR:N - it implies the attacker already holds some access that is then elevated, suggesting PR:L is more honest than PR:N. The I:H/A:H metrics appear inflated for a query endpoint and should be verified against the researcher advisory. Net: a real access-control defect worth patching, but the raw 9.8 likely overstates its true impact; treat as medium-priority absent confirmation that config exposure yields direct admin takeover. |
| Exploit ScenarioDerived | A remote attacker reaches the SmartAdmin configuration query endpoint and, due to the missing/broken authorization check, retrieves configuration data (potentially credentials, tokens, or role settings) that should be restricted, then leverages it to gain higher privileges within the application. No public exploit is confirmed, though a third-party researcher advisory (returnwrong-security-advisories) exists and may contain technical details or proof-of-concept. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An authorization bypass in the SmartAdmin (1024-lab/smart-admin) v3.30.0 configuration query endpoint allows a remote attacker to read configuration data they are not entitled to access and to escalate privileges within the application. The vendor scores this as maximum severity (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating that realistic exploitation likely requires an existing low-privilege session and that the dominant impact is disclosure of sensitive configuration content rather than full system takeover. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS remains low at 0.22% (13th percentile), so the near-maximum vendor score is not reinforced by exploitation or exploitation-likelihood signals.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis, so defenders should not rely on a version upgrade until the upstream project publishes a fixed release; check https://github.com/1024-lab/smart-admin and the advisory at https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-88617.md for a fix commit or patched tag. Until then, apply compensating controls in order of effectiveness: restrict the SmartAdmin instance and its configuration query endpoint to a trusted management network, VPN, or bastion rather than exposing it to the internet - the trade-off is that remote administrative access now requires VPN connectivity; front the application with a reverse proxy or API gateway that enforces role-based authorization on configuration endpoints so that only administrator roles can reach them, accepting that gateway rules must be maintained as endpoints change and that internal, non-proxied callers bypass the control; and, if the endpoint is not operationally required, block or disable it at the proxy or via a WAF rule, at the cost of losing the configuration query feature. Because the primary risk is disclosure of configuration contents (assessed C:H), treat any configuration data reachable through this endpoint as potentially compromised: inventory the secrets, API keys, database credentials, and tokens it exposes and rotate them, and review access logs for anomalous reads of configuration paths. Monitor vendor channels for a patched release and upgrade to the exact fixed version once one is published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-863 (Incorrect Authorization): the configuration query endpoint performs authentication but fails to verify that the requesting principal actually holds the authority required to read the requested configuration, allowing a caller to obtain settings and potentially embedded secrets outside their intended scope. This is distinct from a pure authentication bypass (the input tags label it 'Authentication Bypass'), and the practical security question is whether the endpoint is reachable without any session at all or is only weak with respect to role checks - the vendor's PR:N vector and the assessed PR:L vector diverge precisely on this point. Because the endpoint is a network-facing HTTP interface, AV:N/AC:L hold under both readings, and the assessed C:H reflects that configuration stores frequently contain credentials, tokens, connection strings, and internal service addresses that materially aid lateral movement and privilege escalation. Availability impact is not supported by the available data (assessed A:N), and the integrity effect is judged limited (assessed I:L). Formal product enumeration is weak: the CPE supplied is a wildcard (cpe:2.3:a:n/a:n/a:*) and the EUVD affected-version field is 'n/a n/a', so no authoritative machine-readable version scope exists beyond the stated v3.30.0 in the description.
Know when Smartadmin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote low-complexity broken-authZ on a query endpoint primarily leaks config (C:H); 'escalate privileges' implies an existing foothold so PR:L, with only secondary integrity (I:L) and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.
Executive ViewAI
SmartAdmin v3.30.0 contains a critical authorization bypass (CVE-2026-88617) that could allow an authenticated attacker with low privileges to access sensitive configuration data and escalate privileges. While the vendor assigns a maximum CVSS score of 9.8, independent assessment indicates exploitation requires an existing low-privilege session and primarily impacts confidentiality, with no public exploit identified at time of analysis. Organizations using this product should prioritize mitigation due to the potential for data exposure and privilege escalation, though the immediate risk is tempered by the low EPSS score and lack of observed exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the configuration query endpoint to trusted IPs, enforcing strong authentication and least privilege for SmartAdmin users, implementing WAF rules to detect and block anomalous requests, and monitoring for unauthorized access to configuration data. Consider temporarily disabling the vulnerable endpoint if not essential.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Smartadmin
View allSmartAdmin versions up to 3.29 contain a template injection vulnerability in the FreeMarker template handler that allows
A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the fi
A weakness has been identified in 1024-lab/lab1024 SmartAdmin versions up to 3.29. is affected by cross-site scripting (
Exploit-DB