CVE-2026-110117 Details

A missing authorization vulnerability has been identified in SmartAdmin versions through 3.30.0, specifically within the AdminProtectController. This vulnerability allows authenticated low-privileged employees to alter system-wide level-3 protection settings. The issue arises because the controller's endpoints lack proper authorization annotations, leaving them accessible to any authenticated user who is not a super-admin. As a result, these users can disable critical security features such as login lockout and two-factor authentication, weaken password policies, and delete login failure records.

Add the missing authorization annotations to the AdminProtectController's state-changing endpoints. This can be done by applying the '@SaCheckPermission' annotation to the 'updateConfig' and 'batchDelete' methods, ensuring that only authorized roles can access these functions.