CVE-2026-121543

42th percentile - higher than 42% of all known CVEs

smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.

An authenticated user can escalate privileges to administrator and take control of all integrated systems, leading to full compromise of confidentiality and integrity.

Update smart-sso to a version later than 2.0.1, and until then restrict access to admin console APIs and enforce authorization at the application layer.