CVE-2026-70559

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

PT-2026-68783

Name of the Vulnerable Software and Affected Versions Dinky version 1.2.5 Description The getAll function in the SysConfigController contains a method-level @SaIgnore annotation that bypasses the class-level @SaCheckLogin security check. This allows unauthenticated remote callers to access the GE...