---
id: "CVE-2026-111723"
kind: "vulnerability"
aliases: ["CVE-2026-111723"]
title: "LingGuo-Drama: any registered user can take over admin accounts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "LingGuo-Drama", "fixed": [], "affected": "<= 8a6924adf8142678919b4d9a08b9d60c49dcfbed (main, no release tags)", "ecosystem": "other"}]
ecosystems: []
tags: ["authz", "go", "lingguo-drama", "other", "self-hosted"]
not_affected_if: ["no-admin-api-exposed", "open-registration-disabled"]
published_at: "2026-10-16T18:17:56+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-24T00:24:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111723", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:24:37+00:00"}]
---

# LingGuo-Drama: any registered user can take over admin accounts

LingGuo-Drama's /admin/v1/admins routes sit behind a JWT-presence middleware with no role check. Registration is open at POST /admin/v1/auth/register. Any self-registered user can list every account with its bcrypt hash (GET), overwrite any account's password and authority_id (PUT /admin/v1/admins/1 takes over the default admin), and delete accounts. The project has no release tag and no fix as of 2026-10-24. The same write-up also reports an IDOR on per-id project endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:LingGuo-Drama affected <= 8a6924adf8142678919b4d9a08b9d60c49dcfbed (main, no release tags) fixed ?

## How to check

You are affected if you run LingGuo-Drama (spiritFruit Go backend) built from commit 8a6924adf8142678919b4d9a08b9d60c49dcfbed or earlier (no releases exist; check git rev-parse HEAD). Check whether POST /admin/v1/auth/register is reachable. As any registered user, GET /admin/v1/admins returning 200 means you are exposed. The Docker quick-start ships the default admin/123456 login; change it.

## Fix

No fixed commit or release found. Until upstream patches: block /admin/v1/auth/register and /admin/v1/admins* at the reverse proxy, or keep the app off the internet; change the default admin password (admin/123456); rotate the admin password and review the admins table for unexpected accounts or raised authority_id. Fix in code: add a role/authority check to the admins route group.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111723
- 2026-10-24T00:24:37+00:00 analyst — Read reporter write-up (hackmd, static review only, no runtime test) and VulnCheck advisory. No fix, no release tags; GitHub issue #10 (Oct 22) open. No public exploit found and no exploitation reports; social not searched. Same write-up also reports a project IDOR not covered by this CVE.

## Documents

- [advisory] LingGuo-Drama: broken access control (reporter write-up, static review) https://hackmd.io/@hieuPenguinnn/lingguo-drama-broken-access-control
- [advisory] VulnCheck advisory CVE-2026-111723 https://www.vulncheck.com/advisories/lingguo-drama-through-commit-8a6924a-broken-access-control-via-admin-v1-admins-api
- [mentions] LingGuo-Drama issues (#10 security report, open, no fix) https://github.com/LingGuoAI/LingGuo-Drama/issues

## From the sources

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_