Vulnerability Description
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users
References
- https://github.com/1024-lab/smart-admin
- https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-202
FAQ
What is CVE-2026-88620?
CVE-2026-88620 is a documented vulnerability. SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permissi...
How severe is CVE-2026-88620?
CVSS scoring is not yet available for CVE-2026-88620. Check NVD for updates.
Is there a patch for CVE-2026-88620?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.