A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. (CVE-2026-16450)

The vulnerability exists in the getTenantId function within the /api/system/sys/dept/page endpoint of the MyBatis-Plus Tenant Plugin used by zsadmin2025 ZS-Admin. Manipulating the X-Tenant-Id argument leads to an authorization bypass, allowing unauthorized access. The product's rolling release model means versioning details for affected or fixed releases are not provided. The issue was reported early to the project, but no response or remediation has been published. Exploit code is publicly available, indicating potential for exploitation.

Successful exploitation results in an authorization bypass, potentially allowing attackers to access or manipulate tenant-specific data without proper permissions. This could lead to unauthorized data exposure or modification. The vulnerability can be exploited remotely without user interaction. However, no known active exploitation in the wild has been reported.

No official fix or patch has been released by the vendor as of now. Since the project has not responded, users should monitor the vendor's communications for updates. In the meantime, consider implementing additional access controls or network-level restrictions to limit exposure to the vulnerable endpoint. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.