MinorCritical vulnerability

CVE-2026-111365 (CVSS 7.0)

NVD · officialPublished Oct 15, 2026Risk 23/100EPSS 0.3%

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.

Technical details

CVSS

7.0

AV:NetworkAC:LowPR:HighUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source