Missing Authorization Vulnerability in B3log Symphony by B3log

CVE-2026-110105

What is CVE-2026-110105?

B3log Symphony prior to version 3.6.4 is susceptible to a missing authorization vulnerability. This allows unauthenticated attackers to access sensitive admin routes, as the PermissionMidware.check mechanism fails to enforce proper permission for specific routes. Attackers can exploit this flaw to manipulate reports, remove tags, and assign user points without any form of audit logging. Key endpoints affected include /admin/report/ignore/{reportId}, /admin/tags/remove-unused, and /admin/user/{userId}/init-point, posing serious security risks to the application.

References