CVE-2026-121543

The smart-sso application, versions through 2.0.1 , is vulnerable to an incorrect authorization flaw within the PermissionFilter component. This vulnerability occurs because unlisted paths are permitted by default, allowing any authenticated user to access restricted admin console APIs . An attac...

CVE-2026-121543 smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation

smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset...

CVE-2026-121543 smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation

smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset...