CVE-2026-110105 Details

A missing authorization vulnerability has been identified in B3log Symphony versions through 3.6.4. This vulnerability allows unauthenticated attackers to access admin routes because the permission middleware does not enforce authorization for routes lacking specified permission rules. Attackers can exploit this to manipulate reports, tags, and user points without leaving an audit trail.

To address this vulnerability, add the missing permission rules for the affected admin routes in the 'symphony.properties' file. Additionally, update the permission middleware to deny access to admin routes that do not have a corresponding rule, ensuring that all admin actions require the appropriate authorization.