Cool Admin Midway
Monthly
Authorization bypass in cool-admin-midway through 8.0.0 lets a department-scoped administrator holding sys:user:* permissions read, modify, or delete user records belonging to other departments by supplying an arbitrary user id to the /admin/sys/user/info, /admin/sys/user/update, or /admin/sys/user/delete endpoints. Because the base CRUD service never validates that the requested user id falls within the caller's department, the attacker can reset the password or roles of higher-privileged accounts (turning limited departmental admin rights into full account takeover) or delete accounts outright. Exploitation requires a valid authenticated admin account with user-management permissions, no anonymous access is possible, and no public exploit code was identified at time of analysis; the independently assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as high severity, treating the department-scoped admin as a low-privilege authenticated user rather than the high-privilege PR:H reading used in the 4.0 vector accompanying the CVE record.
Authorization bypass in Cool Admin Midway through 8.0.0 allows an authenticated non-superadmin administrator who holds sys:role permissions to read, update, or delete other administrators' role records by supplying arbitrary role IDs to the base CRUD role endpoints. This changes menu and department grants for other users and can escalate the attacker's effective access; exploitation requires a valid admin session with role-management rights, making the realistic threat a malicious or compromised low-privilege admin rather than an anonymous remote attacker. The assessed CVSS 3.1 vector is 7.0 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and no public exploit identified at time of analysis.
Authorization bypass in cool-admin-midway through 8.0.0 lets a department-scoped administrator holding sys:user:* permissions read, modify, or delete user records belonging to other departments by supplying an arbitrary user id to the /admin/sys/user/info, /admin/sys/user/update, or /admin/sys/user/delete endpoints. Because the base CRUD service never validates that the requested user id falls within the caller's department, the attacker can reset the password or roles of higher-privileged accounts (turning limited departmental admin rights into full account takeover) or delete accounts outright. Exploitation requires a valid authenticated admin account with user-management permissions, no anonymous access is possible, and no public exploit code was identified at time of analysis; the independently assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as high severity, treating the department-scoped admin as a low-privilege authenticated user rather than the high-privilege PR:H reading used in the 4.0 vector accompanying the CVE record.
Authorization bypass in Cool Admin Midway through 8.0.0 allows an authenticated non-superadmin administrator who holds sys:role permissions to read, update, or delete other administrators' role records by supplying arbitrary role IDs to the base CRUD role endpoints. This changes menu and department grants for other users and can escalate the attacker's effective access; exploitation requires a valid admin session with role-management rights, making the realistic threat a malicious or compromised low-privilege admin rather than an anonymous remote attacker. The assessed CVSS 3.1 vector is 7.0 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and no public exploit identified at time of analysis.