CVE-2026-82835: Improper Access Controls in caoqianming django-vue-admin

This vulnerability affects caoqianming django-vue-admin version 1.0. It is caused by improper access control checks in the /api/file/ endpoint, specifically related to the manipulation of the file_id parameter. An attacker with low privileges can remotely exploit this flaw without user interaction to gain unauthorized access to files or resources. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor was contacted but did not provide any response or patch. Public exploit code has been released, increasing the risk of exploitation.

Successful exploitation allows an attacker with low privileges to bypass access controls and access files or resources they should not be authorized to access. This can lead to unauthorized data disclosure or modification. The vulnerability is remotely exploitable without user interaction, increasing its risk. However, no known active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded to the disclosure, users should consider implementing additional access control checks or restricting access to the /api/file/ endpoint as a temporary mitigation. Monitor for vendor advisories for any future fixes. Avoid exposing the vulnerable version 1.0 of django-vue-admin to untrusted networks until a fix is available.