Live › vulnerability › CVE-2026-121543
smart-sso through version 2.0.1 has a PermissionFilter flaw where unlisted paths are allowed by default. Any authenticated user can call admin console APIs, such as /admin/user-role/save, to make themselves an administrator and reset passwords.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Systems running smart-sso 2.0.1 or earlier where a normal authenticated account can reach the admin console APIs. The flaw is in the PermissionFilter default-allow behavior for unlisted paths, so deployments that restrict admin paths at another layer may be less exposed. Teams not using smart-sso can skip it.
No product ranges from the sources yet.
2.0.1 or earlier./admin/user-role/save.2.0.1; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.
This page as .md · .json · in your agent: get_signal("CVE-2026-121543")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.