CVE-2026-111355

Medium · CVSS 5.3

Published 2026-10-15

CVSS

5.3

Medium

EPSS

—

exploit probability

Active Exploit

not yet listed

Medium — next window — Medium severity. Include in your next scheduled maintenance window.

What is CVE-2026-111355?

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.

CVSS Score Explained

CVSS 5.3 is Medium severity. Exploitation usually requires some specific conditions (local access, user interaction, or a particular config). Still worth patching in your next maintenance window.

EPSS Exploitation Probability

No EPSS score yet — model needs more data on this CVE.

References & Patches

Track vulnerabilities for your stack

Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.

Set up my stack watchlist What is a CVE?

Recent CVEs

Browse all CVEs →CISA KEV list →My watchlist →