CVE-2026-111365: Authorization Bypass Through User-Controlled Key in cool-team-official cool-admin-midway

CVE-2026-111365 is an authorization bypass vulnerability in cool-admin-midway through version 8.0.0. The vulnerability arises because the system does not properly restrict access to role management endpoints (/admin/sys/role/info, update, delete). Administrators without superadmin privileges but with sys:role permissions can supply arbitrary role IDs to manipulate roles belonging to other administrators. This allows unauthorized reading, modification, or deletion of roles, which can lead to privilege escalation by rewriting menu and department grants.

Attackers with ordinary sys:role permissions can exploit this vulnerability to change the roles of other administrators, potentially escalating their privileges or disrupting administrative controls. This compromises the integrity of role-based access control within the affected system, leading to unauthorized access and modification of sensitive administrative functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict sys:role permissions to trusted administrators only and monitor role management activities closely to detect unauthorized changes.