Skip to content
Threat Feed
Subscribe
high advisory PoC

smart-sso: Incorrect authorization in PermissionFilter (CVE-2026-121543)

An incorrect authorization vulnerability in smart-sso versions 2.0.1 and earlier allows authenticated users to access administrative APIs due to a permissive default configuration in PermissionFilter.

CVE search metadata

CVE search record: CVE-2026-121543. Severity: high. CVSS: 8.8. KEV: no. Product: smart-sso (<= 2.0.1). Brief: smart-sso: Incorrect authorization in PermissionFilter (CVE-2026-121543). Brief link: https://feed.craftedsignal.io/briefs/2026-11-smart-sso-auth/

Triage facts

Revision 2
Applicability
smart-sso (<= 2.0.1)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 2Nov 3, 21:28 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    poc_available

    Changed: claim_state, has_poc, lastmod, poc_references, references, updates

    Sources: 1

The PermissionFilter component in smart-sso up to version 2.0.1 fails to properly restrict access to administrative console APIs. Because the filter permits unlisted paths by default, any authenticated user can invoke sensitive administrative functions. An attacker can exploit this to perform actions such as calling '/admin/user-role/save' to assign themselves administrative privileges, reset passwords, or manage applications across integrated systems.

Impact

Exploitation allows an authenticated user to achieve full administrative control over the smart-sso environment. This includes the ability to modify user roles, perform password resets, and gain management access to integrated systems linked to the SSO platform.

Recommendation

  • Update smart-sso to a version beyond 2.0.1 that addresses the permissive authorization logic in PermissionFilter.
  • Audit access logs for unauthorized requests to the '/admin/' path hierarchy made by non-administrative user accounts.
  • Configure the web server or application firewall to explicitly deny access to administrative API endpoints for all users except those assigned to the administrator role.

Immediate actions

Identify and patch all instances of smart-sso versions 2.0.1 and earlier

IT Operations 48h

Threat Hunt

Investigate access logs for requests to /admin/ paths originating from non-administrative service accounts or user sessions

T1068 high high confidence hunt now

Data: Web access logs (cs-uri-stem, cs-username)

Mitigations

Implement Web Application Firewall (WAF) rules to block /admin/* paths from non-administrative segments

immediate SOC

CVE-2026-121543

Detection coverage 1

Detect Potential Unauthorized Access to smart-sso Admin APIs

high

Detects unauthorized access attempts to smart-sso administrative API endpoints by monitoring requests to the /admin/ path hierarchy

sigma tactics: privilege-escalation techniques: T1068 sources: webserver

Detection queries are available on the platform. Get full rules →