Missing Authorization Vulnerability in LingGuo-Drama Product by LingGuoAI

CVE-2026-111723

What is CVE-2026-111723?

LingGuo-Drama contains a missing authorization flaw that allows any registered user to exploit the /admin/v1/admins API, which is only secured by AuthAdminJWT. This vulnerability permits unauthorized users to manage all user accounts, including self-registration, accessing bcrypt password hashes, resetting the admin password, elevating user roles, and deleting accounts. Proper access controls are crucial to prevent these significant security breaches.

References