CVE-2026-111365 Details

A vulnerability allowing authorization bypass has been identified in Cool-Admin Midway versions through 8.0.0. This issue enables non-superadmin admins to read, modify, or delete roles of other admins by using arbitrary role IDs. The vulnerability arises because the role management system does not properly enforce object-level authorization, allowing admins with standard role management permissions to interfere with each other's roles. Exploitation of this vulnerability can lead to unauthorized changes in role-based access controls, affecting the permissions of other admins and their users.

To address this vulnerability, object-level authorization checks should be implemented for the 'update', 'delete', and 'info' operations in the role management service. This can be done by overriding these methods to enforce ownership checks, ensuring that admins can only manage roles they own or have been granted access to. Additionally, the same authorization principles should be applied to the user management service to prevent department-scoped admins from accessing records outside their assigned scope.