Threat database

cool-admin-midway versions up to and including 8.0.0 contain an authorization bypass vulnerability. This flaw allows department-limited administrators to manage users outside their assigned departments by supplying arbitrary user IDs. Attackers with sys:user:* permissions can exploit this to read user records, reset passwords and roles, or delete user accounts.

cool-admin-midway versions up to and including 8.0.0 contain an authorization bypass vulnerability. This flaw allows non-superadmin administrators with ordinary sys:role permissions to read, modify, or delete roles of other administrators by supplying arbitrary role IDs. Exploiting this vulnerability enables attackers to alter menu and department grants, effectively changing other users' access rights.