Authorization Bypass in Zhontai Admin.Core Affects System Integrity

CVE-2026-111355

What is CVE-2026-111355?

An authorization bypass vulnerability within Zhontai Admin.Core up to version 10.1.0 enables authenticated users to bypass department-specific DataScope restrictions. By manipulating input, attackers with user or organization module permissions can exploit UserService and OrgService endpoint methods. This allows them to read, modify, disable, and delete users across different departments, posing a significant threat to data integrity and user privacy.

References