Threats affecting pkg:github/1024-lab/smart-admin

CVE-2026-108923 is a medium severity vulnerability in 1024-lab smart-admin up to version 3.30.0. It involves improper access controls in the /support/config/queryByKey functionality of the Support Config Query component. The vulnerability arises from manipulation of the configKey argument, allowing remote attackers to bypass access restrictions. The issue was reported early to the project, but no response or patch has been provided yet. Exploit details have been publicly disclosed, though no known exploits are currently observed in the wild.

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code.

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality intended for authorized administrators.

CVE-2026-7468 is a medium severity vulnerability in 1024-lab smart-admin up to version 3.30.0 involving improper access controls in the /smart-admin-api/druid/index.html file of the Demo Site component. The vulnerability can be exploited remotely without authentication and has been publicly disclosed. The vendor has not yet responded or provided a fix. The CVSS 4.0 base score is 6.9, reflecting network attack vector and no required privileges or user interaction. No official patch or mitigation guidance is currently available.