Authorization Bypass in cool-admin-midway

CVE-2026-111366 is an authorization bypass vulnerability affecting the cool-admin-midway framework up to version 8.0.0. The vulnerability resides in the administrative API handling, where validation logic fails to enforce department-level scoping for users possessing 'sys:user:*' permissions. This flaw allows an authenticated administrator, limited to specific departments, to manipulate user data belonging to other departments by submitting arbitrary user IDs in API requests. Successful exploitation enables unauthorized record retrieval, password resets, role modification, and account deletion. Given that this vulnerability permits privilege escalation by manipulating administrative access controls, it poses a significant risk to organizations using the affected framework for user management.

Impact

Successful exploitation allows an attacker to compromise the integrity and confidentiality of user accounts system-wide. Unauthorized actors can perform administrative functions across the entire user base, bypassing organizational department boundaries. This can lead to mass account compromise, privilege escalation, and data exfiltration.

Recommendation

• Upgrade cool-admin-midway to a patched version beyond 8.0.0 as soon as it becomes available.
• Audit logs for administrative actions (e.g., password resets, role updates, account deletions) initiated by accounts with department-restricted access to identify potential exploitation attempts.
• Temporarily restrict access to '/admin/sys/user/' endpoints if administrative functions cannot be verified for all assigned 'sys:user:*' administrators.