CVE-2026-16450
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Vulnerability in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The getTenantId function in /api/system/sys/dept/page of the MyBatis-Plus Tenant Plugin allows authorization bypass via manipulation of the X-Tenant-Id argument. Remote attack, exploit publicly available.
Risk Assessment
Risk of unauthorized access to system data and functions, potentially leading to full application compromise.
Recommendation
Update the software to the latest version immediately. If unavailable, temporarily restrict API access or apply WAF rules to block X-Tenant-Id header manipulation.
Other vulnerabilities in ZS-Admin
See all- CVE-2026-16451Medium
Unrestricted file upload vulnerability in ZS-Admin up to version b52e145. An unknown function in /api/system/file/upload in the SysFileController component does not restrict the uploaded file type, allowing remote upload of arbitrary files. The exploit is public.
- CVE-2026-16449Medium
In ZS-Admin up to version b52e14536d59fda11e56e2536a1c32e82a38cead, the function OrderItem.asc/OrderItem.desc in file /api/system/sys/dept/page of component com.zs.sys.dept.controller.SysDeptController is vulnerable to SQL injection via manipulation of the orderField argument. The attack can be carried out remotely. The exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization bypass. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.