Live › vulnerability › CVE-2026-111723
Go to dashboardLingGuo-Drama's /admin/v1/admins routes sit behind a JWT-presence middleware with no role check. Registration is open at POST /admin/v1/auth/register. Any self-registered user can list every account with its bcrypt hash (GET), overwrite any account's password and authority_id (PUT /admin/v1/admins/1 takes over the default admin), and delete accounts. The project has no release tag and no fix as of 2026-10-24. The same write-up also reports an IDOR on per-id project endpoints.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| LingGuo-Drama | other | <= 8a6924adf8142678919b4d9a08b9d60c49dcfbed (main, no release tags) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-111723")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.