CVE-2026-111355 Details

A vulnerability allowing authorization bypass has been identified in zhontai Admin.Core versions through 10.1.0. This vulnerability allows authenticated users to circumvent department DataScope restrictions by using out-of-scope record IDs. Attackers with user or organization module permissions and a DataScope of 'Dept' or 'Self' can exploit this issue by accessing UserService and OrgService methods that retrieve records by ID. This exploitation enables them to read, modify, disable, or delete users in other departments.

Apply the same department DataScope checks to the by-ID endpoints that are already implemented in the list endpoints. Additionally, consider promoting the UserEntity and OrgEntity to include data ownership fields, so that the global filters can be applied automatically.