CVE-2026-111366: Authorization Bypass Through User-Controlled Key in cool-team-official cool-admin-midway

CVE-2026-111366 is an authorization bypass vulnerability in cool-admin-midway through version 8.0.0. The vulnerability arises because department-limited admins can supply arbitrary user IDs to perform management actions on users outside their departments. Specifically, attackers holding sys:user:* permissions can call endpoints such as /admin/sys/user/info, update, or delete to access or modify user data beyond their intended scope.

Exploitation of this vulnerability allows attackers with elevated sys:user:* permissions to bypass departmental restrictions and manage user accounts outside their authorized scope. This includes reading sensitive user records, resetting passwords and roles, and deleting user accounts, potentially leading to unauthorized access, privilege escalation, and disruption of user services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict sys:user:* permissions to trusted administrators only and monitor for suspicious use of user management endpoints.