CVE-2026-111723

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...

EUVD-2026-103015

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...

CVE-2026-111723

The LingGuo-Drama software (through commit 8a6924a ) contains a Broken Access Control vulnerability (CWE-862) in the /admin/v1/admins API. The root cause is a missing authorization check where the API is only protected by AuthAdminJWT , allowing any registered user to perform administrative actio...

PT-2026-116122

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...