Authorization Bypass Vulnerability in Cool-Admin Midway by Cool Team

CVE-2026-111365

What is CVE-2026-111365?

The Cool-Admin Midway product versions prior to 8.0.0 are susceptible to an authorization bypass vulnerability. This issue allows users with ordinary sys:role permissions to access and manipulate the roles of other admin users. Specifically, non-superadmin users can exploit this flaw by supplying arbitrary role IDs when accessing the /admin/sys/role/info endpoint. This can lead to unauthorized changes in menu and department privileges, potentially altering effective access levels for various users within the system. Organizations utilizing these affected versions are advised to update promptly to mitigate the risk associated with this vulnerability.

References