CVE-2026-111366

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user IDs. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

Department-limited admins can access user data and accounts outside their scope, leading to privilege escalation and confidentiality breaches. Password and role resets and account deletions are possible, potentially disrupting the organization.

Update cool-admin-midway to a version newer than 8.0.0 if available, or implement fixes enforcing department membership verification. Audit sys:user:* permissions and restrict them to the minimum necessary.