Authorization Bypass in cool-admin-midway Affects User Management Functions

CVE-2026-111366

What is CVE-2026-111366?

cool-admin-midway version 8.0.0 is vulnerable to an authorization bypass, which allows department-limited administrators to manipulate user accounts outside of their assigned departments. By providing arbitrary user IDs, attackers with sys:user:* permissions can invoke the /admin/sys/user/info, update, or delete endpoints. This vulnerability could potentially enable unauthorized access to sensitive user data, including reading records, resetting passwords, modifying roles, or even deleting user accounts entirely.

References