CVE-2026-111723
HighCVSS 8.8Summary
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password, raise their authority_id, and delete accounts.
Risk Assessment
Any registered user can take full control over all accounts in the system, including the administrator account, leading to complete application compromise.
Recommendation
Implement proper administrative authorization checks in the /admin/v1/admins API and update LingGuo-Drama to a version containing the fix as soon as possible.
Other vulnerabilities in LingGuo-Drama
Original NVD description (English source)
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS