{"id":"CVE-2026-121543","kind":"vulnerability","aliases":["CVE-2026-121543"],"related":[],"title":"smart-sso: any logged-in user can grant themselves administrator role","description":"smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.","summary":"smart-sso through version 2.0.1 has a PermissionFilter flaw where unlisted paths are allowed by default. Any authenticated user can call admin console APIs, such as /admin/user-role/save, to make themselves an administrator and reset passwords.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","self-hosted","smart-sso","sso"],"not_affected_if":["admin-paths-blocked-upstream","version-after-2.0.1"],"how_to_check":"- Check the smart-sso version in your dependency manifest and confirm whether it is `2.0.1` or earlier.\n- Look for the PermissionFilter class and whether unlisted admin paths are denied by default.\n- Test whether a non-admin account can reach `/admin/user-role/save`.","fix":"- Move to a smart-sso release later than `2.0.1`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-03T16:17:25+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","triaged_at":"2026-11-03T16:23:37+00:00","updated_at":"2026-11-03T16:23:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:23:37Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a smart-sso release later than `2.0.1`; the sources do not name the exact fixed version.","reach":"network","title":"smart-sso: any logged-in user can grant themselves administrator role","impact":"high","summary":"smart-sso through version 2.0.1 has a PermissionFilter flaw where unlisted paths are allowed by default. Any authenticated user can call admin console APIs, such as /admin/user-role/save, to make themselves an administrator and reset passwords.","audience":"businesses","category":"package","nicknames":[],"who_cares":["smart-sso","java","self-hosted","sso"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"any logged-in user becomes admin and resets passwords","analyst_note":"Confirm the first fixed smart-sso version from the linked patch on github.com and the exact PermissionFilter change.","how_to_check":"- Check the smart-sso version in your dependency manifest and confirm whether it is `2.0.1` or earlier.\n- Look for the PermissionFilter class and whether unlisted admin paths are denied by default.\n- Test whether a non-admin account can reach `/admin/user-role/save`.","plain_action":"","needs_analyst":true,"not_affected_if":["version-after-2.0.1","admin-paths-blocked-upstream"],"who_is_affected":"Systems running smart-sso 2.0.1 or earlier where a normal authenticated account can reach the admin console APIs. The flaw is in the PermissionFilter default-allow behavior for unlisted paths, so deployments that restrict admin paths at another layer may be less exposed. Teams not using smart-sso can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4193,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121543':16A,19A '-2026':15A,18A '/admin/user-role/save':56B,97C '2.0.1':34B,69C 'across':112C 'admin':51B,84C 'administr':12A,61B,102C 'allow':43B,78C 'api':53B,86C 'applic':111C 'assign':99C 'attack':94C 'authent':47B,80C 'author':73C 'call':50B,83C,96C 'consol':52B,85C 'contain':70C 'cve':14A,17A 'default':45B,93C 'flaw':38B 'grant':10A 'host':24B 'incorrect':72C 'integr':113C 'java':20B 'log':6A 'logged-in':5A 'make':58B 'manag':107C 'packag':21B 'password':64B,105C 'path':41B,89C 'permissionfilt':37B,76C 'permit':91C 'reset':63B,104C 'role':13A,103C,109C 'self':23B 'self-host':22B 'smart':2A,26B,30B,66C 'smart-sso':1A,25B,29B,65C 'sso':3A,27B,28B,31B,67C 'system':114C 'unlist':40B,88C 'user':8A,48B,81C,108C 'version':33B 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Systems running smart-sso 2.0.1 or earlier where a normal authenticated account can reach the admin console APIs. The flaw is in the PermissionFilter default-allow behavior for unlisted paths, so deployments that restrict admin paths at another layer may be less exposed. Teams not using smart-sso can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","package","selfhosted","smartsso","sso"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121543","severity":null,"published_at":"2026-11-03T16:17:25+00:00","modified_at":"2026-11-03T16:17:25+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","fetched_at":"2026-11-03T16:21:43+00:00","note":null}],"documents":[{"id":58821,"url":"https://github.com/a466350665/smart-sso/commit/9bccabaa5ec5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58822,"url":"https://github.com/a466350665/smart-sso/commit/a74a791bea7fc7b06ce95f52ce5805d8d7886d48","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58823,"url":"https://www.vulncheck.com/advisories/smart-sso-through-2.0.1-incorrect-authorization-in-permissionfilter-enables-admin-escalation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}