LingGuo-Drama: Missing authorization in admin accounts API

Summary

LingGuo-Drama, an AI-based platform for mini-dramas and motion comics, has a missing authorization check in its /admin/v1/admins API through commit 8a6924a. Any registered user can use this API to manage all accounts. An attacker can self-register, read bcrypt password hashes, reset the bootstrap administrator's password, raise their own authority level and delete accounts. Exploitation requires only a registered user account, so open self-registration is the main risk factor.

Affected

• LingGuoAI LingGuo-Drama through commit 8a6924adf8142678919b4d9a08b9d60c49dcfbed (git commit range; release numbers unknown)
• Forks and self-built Docker images based on this code are potentially affected; not checked.

Fixed in

Unknown. No fixed version or vendor advisory found.

Workaround

• Restrict access to the /admin path at the reverse proxy or firewall so that only administrative networks can reach it (generic control, not vendor-confirmed).
• Disable or limit open self-registration if the application allows it. Whether it is enabled by default is unknown.

Exploitation

• CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'.
• A third-party technical write-up exists; no public proof-of-concept code was found in the sources.
• Not listed as known exploited in the sources reviewed; CISA KEV status should be checked directly.
• EPSS is very low (about 0.003).

Our recommendation

• Check whether any instance runs commit 8a6924a or earlier, including forks and Docker builds.
• Restrict /admin access to trusted networks and disable public self-registration where possible.
• If an instance was reachable, review all accounts and authority levels, look for unexpected admin accounts, and rotate the bootstrap administrator password, JWT signing secrets and stored credentials.
• Monitor for new accounts and changes to admin accounts. Check the vendor repository for a fix and update as soon as one is available.
• Assess the related IDOR CVE-2026-111722 together with this issue.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Vulnerable code: admins controller github.com
• Vulnerable code: admins model github.com
• Vulnerable code: admin routes github.com
• VulnCheck advisory www.vulncheck.com
• Third-party write-up (HackMD) hackmd.io
• VulDB entry vuldb.com
• CVE List V5 record (Vulners) vulners.com
• LingGuo-Drama repository github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:10.