MEDIUMCVSS v3.1 6.0Vulnerability
CVE-2026-111365
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Epss score
- 0.00258
- Cvss severity
- MEDIUM
- Cvss score
- 6
- Retrieved at
- 2026-10-21T01:24:48+00:00
- Last source
- FIRST EPSS
- Score
- 6
- Cvss version
- 3.1
- Cve id
- CVE-2026-111365
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
- First seen by Signal
- 2026-10-18T13:39:03+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
- Published at
- 2026-10-15T22:19:34.407
- Last modified
- 2026-10-16T18:25:45.343
- Epss percentile
- 0.16472
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph