Admin Core
Monthly
Authorization bypass (IDOR, CWE-639) in zhontai Admin.Core through 10.1.0 allows any authenticated user who holds user- or organization-module permissions configured with a Dept or Self DataScope to read, modify, disable, and delete users and organizations belonging to other departments by simply supplying out-of-scope record ids to the UserService and OrgService by-id methods. Exploitation requires valid credentials with those specific module permissions (CVSS:4.0 5.3 Medium; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so it is network-reachable but not unauthenticated, and it needs no user interaction. Exploitation is confirmed to work against otherwise default DataScope-restricted configurations because the by-id code path omits the scope check; no public exploit code was identified at time of analysis and there is no CISA KEV listing or vendor patch version identified in the available data.
Authorization bypass (IDOR, CWE-639) in zhontai Admin.Core through 10.1.0 allows any authenticated user who holds user- or organization-module permissions configured with a Dept or Self DataScope to read, modify, disable, and delete users and organizations belonging to other departments by simply supplying out-of-scope record ids to the UserService and OrgService by-id methods. Exploitation requires valid credentials with those specific module permissions (CVSS:4.0 5.3 Medium; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so it is network-reachable but not unauthenticated, and it needs no user interaction. Exploitation is confirmed to work against otherwise default DataScope-restricted configurations because the by-id code path omits the scope check; no public exploit code was identified at time of analysis and there is no CISA KEV listing or vendor patch version identified in the available data.