{"id":"CVE-2026-111723","kind":"vulnerability","aliases":["CVE-2026-111723"],"related":[],"title":"LingGuo-Drama: any registered user can take over admin accounts","description":"LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.","summary":"LingGuo-Drama's /admin/v1/admins routes sit behind a JWT-presence middleware with no role check. Registration is open at POST /admin/v1/auth/register. Any self-registered user can list every account with its bcrypt hash (GET), overwrite any account's password and authority_id (PUT /admin/v1/admins/1 takes over the default admin), and delete accounts. The project has no release tag and no fix as of 2026-10-24. The same write-up also reports an IDOR on per-id project endpoints.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"LingGuo-Drama","fixed":[],"affected":"<= 8a6924adf8142678919b4d9a08b9d60c49dcfbed (main, no release tags)","ecosystem":"other"}],"ecosystems":[],"tags":["authz","go","lingguo-drama","other","self-hosted"],"not_affected_if":["no-admin-api-exposed","open-registration-disabled"],"how_to_check":"You are affected if you run LingGuo-Drama (spiritFruit Go backend) built from commit 8a6924adf8142678919b4d9a08b9d60c49dcfbed or earlier (no releases exist; check git rev-parse HEAD). Check whether POST /admin/v1/auth/register is reachable. As any registered user, GET /admin/v1/admins returning 200 means you are exposed. The Docker quick-start ships the default admin/123456 login; change it.","fix":"No fixed commit or release found. Until upstream patches: block /admin/v1/auth/register and /admin/v1/admins* at the reverse proxy, or keep the app off the internet; change the default admin password (admin/123456); rotate the admin password and review the admins table for unexpected accounts or raised authority_id. Fix in code: add a role/authority check to the admins route group.","status":"open","published_at":"2026-10-16T18:17:56+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:33:19+00:00","updated_at":"2026-10-24T00:24:37+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:33:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"LingGuo-Drama: any registered user can take over admin accounts","impact":"high","summary":"LingGuo-Drama's /admin/v1/admins API checks only that the caller has a JWT, not that they are an administrator. Any user who self-registers can read every account's bcrypt hash, reset the bootstrap admin's password, raise their own authority, and delete accounts.","category":"other","who_cares":["lingguo-drama","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker becomes admin, reads password hashes, deletes accounts","analyst_note":"Check the NVD entry and the LingGuo-Drama repository for a fixed commit or release, and whether self-registration is on by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["open-registration-disabled","no-admin-api-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000473,"input_tokens":2937,"output_tokens":359,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the LingGuo-Drama repository for a fixed commit or release, and whether self-registration is on by default.","search":"'-10':97B '-111723':14A,17A '-2026':13A,16A '-24':98B '/admin/v1/admins':34B,136C '/admin/v1/admins/1':76B '/admin/v1/auth/register':52B '2026':96B '8a6924a':119C 'account':11A,61B,69B,84B,133C,149C,167C 'admin':10A,81B 'administr':156C 'allow':126C 'also':104B 'api':137C 'attack':142C 'authadminjwt':141C 'author':73B,123C,163C 'authz':21B 'bcrypt':64B,151C 'behind':37B 'bootstrap':155C 'check':46B 'commit':118C 'contain':120C 'cve':12A,15A 'default':80B 'delet':83B,166C 'drama':3A,20A,25B,32B,116C 'endpoint':113B 'everi':60B,148C 'fix':93B 'get':66B 'go':22B 'hash':65B,152C 'host':29B 'id':74B,111B,164C 'idor':107B 'jwt':40B 'jwt-presenc':39B 'lingguo':2A,19A,24B,31B,115C 'lingguo-drama':1A,18A,23B,30B,114C 'list':59B 'manag':131C 'middlewar':42B 'miss':122C 'open':49B 'overwrit':67B 'password':71B,158C 'per':110B 'per-id':109B 'post':51B 'presenc':41B 'project':86B,112B 'protect':138C 'put':75B,160C 'rais':161C 'read':147C 'regist':5A,56B,128C,146C 'registr':47B 'releas':89B 'report':105B 'reset':153C 'role':45B 'rout':35B 'self':28B,55B,145C 'self-host':27B 'self-regist':54B,144C 'sit':36B 'tag':90B 'take':8A,77B 'user':6A,57B,129C 'via':159C 'vulner':124C 'write':102B 'write-up':101B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111723","severity":null,"published_at":"2026-10-16T18:17:56+00:00","modified_at":"2026-10-20T16:17:00+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111723:653","url":null,"severity":null,"published_at":"2026-10-24T00:24:37+00:00","modified_at":"2026-10-24T00:24:37+00:00","first_seen_at":"2026-10-24T00:24:37+00:00","fetched_at":"2026-10-24T00:24:37+00:00","note":"Read reporter write-up (hackmd, static review only, no runtime test) and VulnCheck advisory. No fix, no release tags; GitHub issue #10 (Oct 22) open. No public exploit found and no exploitation reports; social not searched. Same write-up also reports a project IDOR not covered by this CVE."}],"documents":[{"id":2590,"url":"https://hackmd.io/@hieuPenguinnn/lingguo-drama-broken-access-control","title":"LingGuo-Drama: broken access control (reporter write-up, static review)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2591,"url":"https://www.vulncheck.com/advisories/lingguo-drama-through-commit-8a6924a-broken-access-control-via-admin-v1-admins-api","title":"VulnCheck advisory CVE-2026-111723","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2592,"url":"https://github.com/LingGuoAI/LingGuo-Drama/issues","title":"LingGuo-Drama issues (#10 security report, open, no fix)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}