CVE-2026-108923 Details
Description
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
An access control vulnerability has been identified in 1024-lab Smart-Admin versions through 3.30.0. The issue resides in the Support Config Query component, specifically within the file '/support/config/queryByKey'. The vulnerability allows low-privileged users to read sensitive configuration data, such as the 'super_password', which can be used to bypass authentication and gain unauthorized access to accounts, including those of super administrators. This vulnerability can be exploited remotely and has been publicly disclosed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/1024-lab/smart-admin/ | [email protected] | Vendor |
| https://github.com/1024-lab/smart-admin/issues/137 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-108923 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/995994 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416747 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416747/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 1024-lab smart-admin | <= 3.30.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |