The vulnerability in zsadmin2025 ZS-Admin up to commit b52e14536d59fda11e56e2536a1c32e82a38cead involves improper authorization checks in the getTenantId function of the /api/system/sys/dept/page API endpoint. By manipulating the X-Tenant-Id header, an attacker with low privileges can bypass authorization controls. The product's rolling release model means versioning details are not specified. The issue was reported early but the vendor has not responded or issued a fix. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required beyond low, no user interaction, and low impact on confidentiality.

Successful exploitation allows an attacker with low privileges to bypass authorization controls by manipulating the X-Tenant-Id argument, potentially gaining unauthorized access to tenant-specific data or functionality. The impact on confidentiality is low, and there is no impact on integrity or availability according to the CVSS vector. The vulnerability can be exploited remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, monitor official channels for updates. Until a fix is available, consider restricting access to the affected API endpoint or implementing additional access controls to validate tenant identifiers.