Improper Authorization in SmartAdmin API by 1024-lab
CVE-2026-88620

4.3MEDIUM

Key Information:

Vendor

1024-lab

Status
SmartAdmin API
Vendor
CVE Published:
15 September 2026

What is CVE-2026-88620?

The SmartAdmin API Java17 SpringBoot3, specifically version 3.30.0, is susceptible to an improper authorization vulnerability in the /employee/queryAll endpoint. This issue arises due to a failure in enforcing necessary function-level permissions or data-scope authorization. Consequently, an authenticated user with low privileges can access and retrieve employee records that belong to different departments and users, potentially exposing sensitive information. It is crucial for organizations using this API to implement corrective measures to secure access and protect user data.

References

https://github.com/1024-lab/smart-admin
https://github.com/returnwrong/returnwrong-security-advis...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.