CVE-2026-110117: SmartAdmin Privilege Escalation Vulnerability

CVE-2026-110117 Overview

CVE-2026-110117 is a missing authorization vulnerability [CWE-862] in SmartAdmin through version 3.30.0. The flaw resides in the AdminProtectController component, which exposes level-3 protection configuration endpoints without proper authorization checks. Authenticated low-privileged employees can invoke the updateConfig and loginFailbatchDelete endpoints to alter system-wide security settings. Attackers can disable login lockout, turn off two-factor authentication, weaken password policies, and clear existing lockout records. These changes directly undermine account protections across the entire SmartAdmin deployment.

Critical Impact
Any authenticated employee account can disable platform-wide authentication protections, enabling follow-on credential attacks against all SmartAdmin users including administrators.

Affected Products

SmartAdmin (1024-lab/smart-admin) through version 3.30.0
smart-admin-api-java17-springboot3 module, specifically the sa-admin application
Deployments relying on AdminInterceptor for role-based authorization enforcement

Discovery Timeline

2026-10-13 - CVE-2026-110117 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-110117

Vulnerability Analysis

SmartAdmin implements request authorization through AdminInterceptor, which inspects controller methods for role or permission annotations. The AdminProtectController endpoints that manage level-3 protection settings lack these annotations entirely. As a result, the interceptor permits any authenticated employee session to reach configuration-mutating methods. The affected endpoints include updateConfig, which rewrites protection parameters, and the loginFailbatchDelete endpoint, which erases login failure history. Successful exploitation collapses the defensive posture of the login subsystem, enabling password spraying, brute-force attempts, and bypass of multi-factor controls. The vulnerability is network-reachable and requires only low-level authenticated access to the admin API.

Root Cause

The root cause is a classic authorization gap. The AdminProtectController methods are not decorated with the permission annotations that AdminInterceptor relies on to enforce administrative role checks. Developers assumed authentication alone was sufficient for these endpoints, violating least-privilege expectations for security-sensitive configuration surfaces.

Attack Vector

An attacker with any valid employee credential authenticates to the SmartAdmin API and issues HTTP requests directly to the unannotated AdminProtectController endpoints. By calling updateConfig, the attacker rewrites the protection policy to disable lockout thresholds, remove two-factor requirements, and relax password complexity rules. The attacker then invokes the loginFailbatchDelete endpoint to purge accumulated failure counters, erasing evidence of prior brute-force activity and resetting any pending lockouts. Technical details are available in the VulnCheck Advisory, the HackMD Security Configuration Analysis, and the upstream source in the AdminProtectController source.

Detection Methods for CVE-2026-110117

Indicators of Compromise

HTTP POST or PUT requests to AdminProtectController endpoints such as /admin/protect/updateConfig originating from non-administrator user sessions.
Calls to the loginFailbatchDelete endpoint followed by sudden resets of login failure counters in the database.
Audit log entries showing changes to lockout thresholds, two-factor enforcement, or password policy without a matching administrator approval event.

Detection Strategies

Correlate protection configuration changes with the authenticated user's role; alert on any change issued by a non-admin principal.
Monitor for abnormal sequences where protection settings are weakened and then followed by a surge in login attempts against multiple accounts.
Baseline the frequency of calls to AdminProtectController and alert on access from previously unseen employee identities.

Monitoring Recommendations

Enable verbose request logging on the sa-admin service and ship authentication, authorization, and configuration events to a centralized SIEM.
Track database writes to the level-3 protection tables and the login failure table for unexpected mutations or mass deletions.
Review session logs for low-privileged accounts invoking administrative URLs, which may indicate reconnaissance against unprotected endpoints.

How to Mitigate CVE-2026-110117

Immediate Actions Required

Restrict network exposure of the SmartAdmin API to trusted administrator networks until a patched build is deployed.
Audit all employee accounts for recent calls to AdminProtectController endpoints and revoke sessions that triggered configuration changes.
Manually re-verify level-3 protection settings, including lockout thresholds, two-factor enforcement, and password complexity, and reset any weakened values.

Patch Information

No fixed version is listed in the NVD record at publication time. Monitor the upstream smart-admin GitHub repository for releases after 3.30.0 and the VulnCheck Advisory for remediation guidance. Review the AdminInterceptor source to validate that upgraded builds enforce administrator-only access on the affected endpoints.

Workarounds

Apply a reverse-proxy or web application firewall rule that blocks requests to AdminProtectController paths unless the caller belongs to the administrator role.
Add a custom Spring interceptor or @PreAuthorize annotation to the updateConfig and loginFailbatchDelete methods to require an administrator permission.
Temporarily remove or disable the AdminProtectController routes in environments where level-3 protection changes are managed out-of-band.

bash

# Example NGINX rule to block non-admin access to protect endpoints
location ~* ^/admin/protect/(updateConfig|loginFail/batchDelete)$ {
    if ($http_x_user_role != "ADMIN") {
        return 403;
    }
    proxy_pass http://smart_admin_backend;
}