zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints

Summary

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.

Timeline

1. Oct 15, 2026, 9:43 PM UTCCVE published
2. Oct 16, 2026, 4:31 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 16, 2026, 5:08 PM UTCRecord last updated

Affected versions

• zhontai Admin.Core

  through 10.1.0

References 7