CVE-2026-111723 Details

A missing authorization vulnerability has been identified in LingGuo-Drama, specifically in the admin API for managing accounts. This vulnerability allows any registered user to access and manage all accounts through the /admin/v1/admins endpoint. The issue arises because the API is only protected by a JWT authentication token, without any additional role-based authorization checks. As a result, attackers can exploit this vulnerability to self-register, access and read the bcrypt password hashes of all accounts, reset the password of the bootstrap administrator, elevate their own privileges, and delete accounts.

Implement proper authorization checks on the /admin/v1/admins API to ensure that only users with the appropriate roles can access and manage accounts. Additionally, remove the password field from the admin model's JSON serialization to prevent password hash exposure.