CVE-2026-111355: Authorization Bypass Through User-Controlled Key in zhontai Admin.Core
Description
zhontai Admin.Core versions up to 10.1.0 contain an authorization bypass vulnerability that allows authenticated users with certain permissions to bypass department data scope restrictions. By supplying out-of-scope record IDs to specific service methods, attackers can access and manipulate user records in other departments beyond their authorized scope.
CVSS v4.0
Score 5.3medium
Affected software
zhontai
Admin.Core
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111355 is an authorization bypass vulnerability in zhontai Admin.Core through version 10.1.0. Authenticated users who have user or organization module permissions scoped to Dept or Self can exploit this flaw by providing out-of-scope record IDs to UserService and OrgService by-id methods. This allows them to read, modify, disable, and delete user accounts in departments outside their authorized data scope, effectively bypassing intended access controls.
Potential Impact
The vulnerability enables unauthorized access and modification of user data across departmental boundaries within the application. Attackers with limited scoped permissions can escalate their access to affect users in other departments, potentially leading to data exposure, unauthorized changes, and disruption of user accounts.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to trusted users only and monitor usage of UserService and OrgService by-id methods for anomalous activity.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-15T20:56:00.638Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad14e332cdf04f656608512
Added to database: 10/15/2026, 22:05:39 UTC
Last enriched: 10/15/2026, 22:18:56 UTC
Last updated: 10/15/2026, 22:18:56 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.