Missing Authorization Vulnerability in SmartAdmin Affects AdminProtectController

CVE-2026-110117

What is CVE-2026-110117?

SmartAdmin versions up to 3.30.0 are prone to a vulnerability in the AdminProtectController, where authenticated low-privileged users can exploit missing authorization checks. This flaw allows them to modify critical system-level protections, including disabling login lockout mechanisms, two-factor authentication, and even altering password policies. By invoking the unprotected updateConfig and loginFail batchDelete endpoints, these users can compromise the security of the entire system, putting sensitive data and user accounts at risk.

References