Threats tagged 'ghsa-9gfr-r435-56mx'

CVE-2026-111723 is a missing authorization vulnerability in LingGuoAI's LingGuo-Drama product up to commit 8a6924a. It allows any registered user to access the /admin/v1/admins API, which is protected only by AuthAdminJWT, enabling unauthorized management of all accounts. Exploitation permits attackers to self-register, read bcrypt password hashes of all accounts, reset the bootstrap administrator's password, escalate their authority level, and delete accounts.