CVE-2026-110105: B3log Symphony Auth Bypass Vulnerability

CVE-2026-110105 Overview

CVE-2026-110105 is a missing authorization vulnerability [CWE-862] affecting B3log Symphony through version 3.6.4. The flaw resides in the PermissionMidware.check middleware, which permits access to admin routes that lack permission.rule.url entries. Unauthenticated remote attackers can reach administrative endpoints and perform privileged actions without credentials. Affected endpoints include /admin/report/ignore/{reportId}, /admin/tags/remove-unused, and /admin/user/{userId}/init-point. Successful exploitation lets attackers dismiss abuse reports, delete unused tags, and grant points to arbitrary users, all without audit logging.

Critical Impact

Unauthenticated attackers can invoke admin-only operations against B3log Symphony forums, tampering with moderation state and user point balances without producing audit records.

Affected Products

• B3log Symphony versions up to and including 3.6.4
• The AdminProcessor component in src/main/java/org/b3log/symphony/processor/AdminProcessor.java
• The PermissionMidware component in src/main/java/org/b3log/symphony/processor/middleware/PermissionMidware.java

Discovery Timeline

• 2026-10-13 - CVE CVE-2026-110105 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-110105

Vulnerability Analysis

B3log Symphony implements route-level authorization through the PermissionMidware.check function. This middleware consults a permission rule table keyed by URL to decide whether a caller may invoke an endpoint. When an admin route is not registered in permission.rule.url, the middleware returns success instead of denying by default. The result is that several AdminProcessor endpoints run with no authentication or role check.

The exposed handlers perform state-changing moderation and economy actions. An attacker can call /admin/report/ignore/{reportId} to suppress abuse reports, /admin/tags/remove-unused to purge tag records, and /admin/user/{userId}/init-point to reset or grant a target user's points. None of these invocations produce audit log entries, limiting incident response visibility.

Root Cause

The root cause is a fail-open authorization decision in PermissionMidware.check at lines 94-97 of the middleware. The lookup against permission.rule.url treats a missing rule as implicit permission rather than implicit denial. Admin endpoints added to AdminProcessor without a corresponding permission rule become reachable by any caller, including anonymous ones.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a single HTTP request to one of the vulnerable admin paths with the appropriate path parameter. No session cookie, CSRF token, or administrative role is required. See the HackMD Authorization Analysis and the VulnCheck Advisory on Symphony for request-level detail.

No public proof-of-concept exploit is listed in the enriched data. Readers can review the vulnerable handlers directly in the GitHub AdminProcessor Code and the fail-open check in the GitHub PermissionMiddleware Code.

Detection Methods for CVE-2026-110105

Indicators of Compromise

• HTTP requests to /admin/report/ignore/{reportId} from clients that have not completed an administrator login flow.
• Requests to /admin/tags/remove-unused originating from unauthenticated sessions or non-admin user agents.
• Calls to /admin/user/{userId}/init-point affecting arbitrary user IDs with no corresponding admin session cookie.
• Sudden drops in open abuse reports or user point balances that do not correlate with any admin activity in application logs.

Detection Strategies

• Enable web server access logging and alert on any request matching /admin/* where the authenticated principal is empty or non-administrative.
• Correlate HTTP 200 responses on the three affected endpoints with the absence of audit log entries in Symphony's own logs.
• Baseline normal admin traffic by source IP and flag deviations, since the vulnerable endpoints should only be invoked from a small set of operator addresses.

Monitoring Recommendations

• Forward reverse-proxy or load-balancer logs for the Symphony host to a centralized log platform for retention and query.
• Add a detection rule for POST or GET requests to /admin/report/ignore/, /admin/tags/remove-unused, and /admin/user/*/init-point paths.
• Track changes to the symphony_report, symphony_tag, and symphony_user tables and alert on unattributed modifications.

How to Mitigate CVE-2026-110105

Immediate Actions Required

• Place B3log Symphony behind a reverse proxy and restrict /admin/* paths to trusted administrator source IP ranges.
• Audit the permission.rule.url table and add explicit permission rules for every admin endpoint defined in AdminProcessor.
• Review symphony_report, symphony_tag, and symphony_user records for unexpected changes consistent with the exploitation paths listed above.

Patch Information

The enriched advisory data does not list a fixed version. Operators should monitor the upstream GitHub Symphony Project repository for a release addressing CVE-2026-110105 and the VulnCheck Advisory on Symphony for updates. Until a patched release is available, apply the compensating controls described below.

Workarounds

• Block the three known-vulnerable paths at the reverse proxy for any client that does not present a valid administrator session cookie.
• Modify PermissionMidware.check locally so that routes without a permission.rule.url entry fail closed and return HTTP 403.
• Disable public exposure of the Symphony admin console entirely by binding it to an internal interface or VPN segment.

# Example nginx snippet to restrict vulnerable admin routes to an operator subnet
location ~ ^/admin/(report/ignore/|tags/remove-unused|user/.+/init-point) {
    allow 10.0.0.0/24;
    deny  all;
    proxy_pass http://symphony_upstream;
}