cool-admin-midway: Authorization bypass via user IDs in admin user endpoints

Summary

cool-admin-midway up to and including 8.0.0 does not enforce department restrictions on user IDs supplied to the /admin/sys/user endpoints. A department-limited admin with sys:user:* permissions can read, update, or delete users outside their department. This allows password and role resets as well as account deletion, which can lead to account takeover, including of other administrators.

Affected

• cool-admin-midway versions 0 to 8.0.0 (inclusive)
• Endpoints: /admin/sys/user/info, /admin/sys/user/update, /admin/sys/user/delete
• Attacker requires an authenticated account with sys:user:* permissions

Fixed in

• Unknown. No fixed version or vendor advisory was found at the time of writing.

Workaround

• Remove sys:user:* permissions from department admins who do not need them.
• Restrict access to the admin panel and API to VPN, internal networks, or an IP allowlist; do not expose it directly to the internet.
• Enforce MFA on admin accounts at the reverse proxy or SSO layer.

Exploitation

• CISA SSVC (Vulnrichment): exploitation status 'poc', automatable 'no', technical impact 'total'.
• A public write-up exists; its content could not be verified.
• Not listed in CISA KEV; no confirmed in-the-wild exploitation found.
• Authentication with sys:user permissions is required.

Our recommendation

• Check whether cool-admin-midway is deployed in your environment and whether the admin interface is reachable from outside.
• Contact the vendor or monitor the GitHub repository for a fix, and update as soon as one is released.
• Review sys:user permissions and admin accounts; remove unnecessary rights.
• Audit user create, update and delete events and password or role changes on /admin/sys/user/*.
• Apply the workarounds above until a fix is available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Vulnerable code (user.ts at referenced commit) github.com
• GitHub repository cool-admin-midway github.com
• HackMD write-up hackmd.io
• OpenCVE CVE-2026-111366 app.opencve.io
• VulnCheck related advisory (role endpoints) www.vulncheck.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:56.