CVE-2026-111366 cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints
Attackers with user management permissions can bypass department restrictions to read, modify, or delete user accounts outside their scope.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111366?
CVE-2026-111366 is a high-severity missing authorization vulnerability in cool-team-official cool-admin-midway, published on 15 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.
Weakness: CWE-639
Which versions are affected by CVE-2026-111366?
How do I fix CVE-2026-111366?
No fix has been published for CVE-2026-111366 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111366 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111366 exists.
Sources
Also known as GHSA-ghj7-f59x-5hw6.