Threat database

SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.

CVE-2026-108923 is a medium severity vulnerability in 1024-lab smart-admin up to version 3.30.0. It involves improper access controls in the /support/config/queryByKey functionality of the Support Config Query component. The vulnerability arises from manipulation of the configKey argument, allowing remote attackers to bypass access restrictions. The issue was reported early to the project, but no response or patch has been provided yet. Exploit details have been publicly disclosed, though no known exploits are currently observed in the wild.

CVE-2026-7468 is a medium severity vulnerability in 1024-lab smart-admin up to version 3.30.0 involving improper access controls in the /smart-admin-api/druid/index.html file of the Demo Site component. The vulnerability can be exploited remotely without authentication and has been publicly disclosed. The vendor has not yet responded or provided a fix. The CVSS 4.0 base score is 6.9, reflecting network attack vector and no required privileges or user interaction. No official patch or mitigation guidance is currently available.

A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29. Affected by this issue is the function freemarkerResolverContent of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/mail/MailService.java of the component FreeMarker Template Handler. Executing a manipulation of the argument template_content can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/helpdoc/domain/form/HelpDocAddForm.java of the component Help Documentation Module. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the file smart-admin-web-javascript/src/views/business/oa/notice/components/notice-form-drawer.vue of the component Notice Module. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.