CVE-2026-88619 Details

A missing authorization vulnerability has been identified in 1024-lab SmartAdmin version 3.30.0, specifically within the scheduled-job management module. The vulnerability arises because the AdminSmartJobController exposes scheduled-job management endpoints without proper method-level permission checks. This oversight allows low-privileged authenticated users to access functionalities intended for authorized administrators, such as reading job definitions and logs, executing jobs, and modifying job configurations.

The vulnerability can be addressed by implementing explicit permission requirements for each scheduled-job operation in the AdminSmartJobController. This includes separating privileges for reading, executing, creating, modifying, and deleting jobs, as well as validating the accessibility of jobs and registered implementations. Additionally, recording administrative changes in an audit log is recommended.