CVE-2026-16217: Adminset Authorization Bypass Vulnerability

CVE-2026-16217 Overview

CVE-2026-16217 is an authorization bypass vulnerability in the guohongze adminset project through version 0.61. The flaw resides in the delivery/deli.py file, which implements the Delivery Deployment Endpoint. Attackers can manipulate the project_id argument to bypass authorization checks and access resources belonging to other projects. The vulnerability is remotely exploitable and requires only low-privilege authenticated access. Public disclosure has occurred, and the upstream project has not responded to the reported issue. This weakness is categorized under improper authorization [CWE-285].

Critical Impact
Authenticated remote attackers can bypass authorization controls in the Delivery Deployment Endpoint by tampering with the project_id parameter, gaining unauthorized access to project resources.

Affected Products

guohongze adminset versions up to and including 0.61
Component: Delivery Deployment Endpoint (delivery/deli.py)
Deployments exposing the delivery API to authenticated users

Discovery Timeline

2026-07-19 - CVE-2026-16217 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-16217

Vulnerability Analysis

The vulnerability affects the Delivery Deployment Endpoint implemented in delivery/deli.py within the adminset project. The endpoint accepts a project_id parameter from the client and uses it to identify the target deployment context. The endpoint does not verify that the authenticated user is authorized to operate on the referenced project_id. As a result, a low-privilege user can substitute another project's identifier and interact with resources they should not be able to reach. This is a classic missing authorization check on a user-supplied object reference, weakening tenant isolation across projects.

Root Cause

The root cause is improper authorization [CWE-285]. The delivery handler trusts the project_id value supplied in the request without cross-checking it against the caller's project membership or role assignments. Authentication alone is not sufficient to gate access to project-scoped operations. Because the check is missing rather than merely weak, any authenticated session can drive the endpoint against arbitrary project identifiers.

Attack Vector

Exploitation occurs over the network against a running adminset instance. An attacker authenticates with a low-privilege account, then issues a request to the Delivery Deployment Endpoint while substituting a project_id value belonging to another tenant or project. No user interaction is required. Because the exploit has been publicly disclosed, opportunistic use against exposed instances is plausible. Full technical details are available in the GitHub Issue #161 and the VulDB entry for CVE-2026-16217.

No verified proof-of-concept code is published in the referenced advisories, so the exploitation mechanism is described in prose rather than reproduced here.

Detection Methods for CVE-2026-16217

Indicators of Compromise

Requests to the delivery endpoint carrying project_id values that do not match the authenticated user's project assignments.
Deployment or delivery actions logged against projects the requesting account has never previously accessed.
Sudden increases in 200-OK responses from delivery/deli.py originating from low-privilege accounts.

Detection Strategies

Instrument the delivery handler to log user_id, session role, and requested project_id on every call, then alert on mismatches.
Compare access patterns in application logs against the authorization matrix stored in the adminset database to surface cross-project access attempts.
Deploy web application firewall or reverse proxy rules that enforce allow-lists of project_id values per session where feasible.

Monitoring Recommendations

Forward adminset application logs to a central analytics platform and retain them long enough to investigate authorization anomalies.
Baseline normal per-user project access and alert on deviations, especially bursts of unique project_id values.
Monitor outbound deployment actions triggered through adminset for unexpected target environments or hosts.

How to Mitigate CVE-2026-16217

Immediate Actions Required

Restrict network exposure of adminset to trusted administrative networks or VPN users until a patch is available.
Audit existing user accounts and remove or downgrade any that do not require access to the delivery workflow.
Review recent delivery and deployment history for project_id values that do not match the initiating user's project assignments.

Patch Information

At publication, the adminset project has not responded to the disclosure and no official patch is available. Track the adminset GitHub repository and GitHub Issue #161 for a future fix. Any resolution should add an explicit authorization check that validates the authenticated user's membership in the requested project_id before executing delivery logic in delivery/deli.py.

Workarounds

Place adminset behind a reverse proxy that enforces per-user access controls to the delivery endpoint.
Apply a local patch to delivery/deli.py that validates the caller's project membership against the requested project_id prior to any deployment action.
Disable the delivery deployment feature entirely in environments where it is not actively used.

bash

# Example reverse proxy restriction limiting the delivery endpoint
# to an internal management subnet until an upstream fix is released
location /delivery/ {
    allow 10.10.0.0/24;
    deny  all;
    proxy_pass http://adminset_backend;
}