CVE-2026-88620 Details

A vulnerability has been identified in SmartAdmin API Java17 SpringBoot3 version 3.30.0, where the /employee/queryAll endpoint lacks proper authorization controls. This flaw enables low-privileged authenticated employees to access employee records from other departments and users, violating data-scope authorization requirements. The exposed information includes login names, real names, telephone numbers, departments, positions, email addresses, and administrator flags.

It is recommended to implement function-level permission checks and enforce data-scope authorization for department and user-specific employee queries. Additionally, restrict the returned fields to those necessary for the authorized operation and apply similar authorization checks to related employee lookup methods.