Threat database

A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a manipulation of the argument ID results in information disclosure. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-1196 is an information disclosure vulnerability affecting MineAdmin versions 1.x and 2.x. The flaw exists in the /system/getFileInfoById endpoint, where manipulation of the ID parameter can lead to unauthorized exposure of information. The vulnerability can be exploited remotely but requires a high level of complexity, making exploitation difficult. No user interaction or authentication is required, but the attack complexity and limited impact reduce its severity. The vendor has not responded to the disclosure, and no patches are currently available. Although the exploit has been publicly disclosed, there are no known active exploits in the wild. The CVSS 4.0 base score is low (2.

A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.