{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/cool-admin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cool_admin:cool_admin_midway:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-111366"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cool-admin-midway (\u003c= 8.0.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authorization-bypass","api-security"],"_cs_type":"advisory","_cs_vendors":["cool-admin"],"content_html":"\u003cp\u003eCVE-2026-111366 is an authorization bypass vulnerability affecting the cool-admin-midway framework up to version 8.0.0. The vulnerability resides in the administrative API handling, where validation logic fails to enforce department-level scoping for users possessing 'sys:user:*' permissions. This flaw allows an authenticated administrator, limited to specific departments, to manipulate user data belonging to other departments by submitting arbitrary user IDs in API requests. Successful exploitation enables unauthorized record retrieval, password resets, role modification, and account deletion. Given that this vulnerability permits privilege escalation by manipulating administrative access controls, it poses a significant risk to organizations using the affected framework for user management.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to compromise the integrity and confidentiality of user accounts system-wide. Unauthorized actors can perform administrative functions across the entire user base, bypassing organizational department boundaries. This can lead to mass account compromise, privilege escalation, and data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade cool-admin-midway to a patched version beyond 8.0.0 as soon as it becomes available.\u003c/li\u003e\n\u003cli\u003eAudit logs for administrative actions (e.g., password resets, role updates, account deletions) initiated by accounts with department-restricted access to identify potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eTemporarily restrict access to '/admin/sys/user/' endpoints if administrative functions cannot be verified for all assigned 'sys:user:*' administrators.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:50:39Z","date_published":"2026-10-15T22:50:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cool-admin-auth-bypass/","summary":"An authorization bypass vulnerability in cool-admin-midway through version 8.0.0 allows department-restricted administrators to perform unauthorized administrative actions on users outside their assigned scope.","title":"Authorization Bypass in cool-admin-midway","url":"https://feed.craftedsignal.io/briefs/2026-10-cool-admin-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cool-Admin","version":"https://jsonfeed.org/version/1.1"}