CVE-2026-111343 Details

A missing authorization vulnerability has been identified in Pig version 4.1.1 and earlier. The issue resides in the SysUserController, specifically the user details endpoint. This vulnerability allows any authenticated user to access and read the profiles of other users by sending a GET request to /admin/user/details/{id}. Low-privilege attackers can exploit this by enumerating sequential user IDs to gather personal information such as usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.

The vulnerability can be addressed by adding proper authorization checks to the user details endpoint, ensuring that only users with the appropriate permissions can access the information. Additionally, implementing data-scope restrictions based on the user's department can prevent unauthorized access to profiles outside of their scope.