CVE-2026-2667: Rongzhitong Platform Auth Bypass Flaw

CVE-2026-2667 Overview

A vulnerability has been identified in the Rongzhitong Visual Integrated Command and Dispatch Platform affecting versions up to 20260206. The vulnerability exists in the /dispatch/api?cmd=userinfo endpoint and results from improper access controls (CWE-266: Incorrect Privilege Assignment). This flaw allows unauthorized remote attackers to access sensitive user information without proper authentication or authorization checks.

Critical Impact

Remote attackers can exploit this vulnerability to access user information through the affected API endpoint without proper authorization, potentially leading to information disclosure and further attacks on the system.

Affected Products

• Rongzhitong Visual Integrated Command and Dispatch Platform up to version 20260206

Discovery Timeline

• February 18, 2026 - CVE-2026-2667 published to NVD
• February 19, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2667

Vulnerability Analysis

This vulnerability stems from improper access controls in the Rongzhitong Visual Integrated Command and Dispatch Platform. The affected endpoint /dispatch/api?cmd=userinfo fails to properly verify whether the requesting user has the appropriate privileges to access user information. As a result, unauthenticated or low-privileged attackers can query this API endpoint and retrieve sensitive user data that should be restricted.

The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), indicating that the application does not correctly assign, modify, track, or check privileges for an actor. This type of flaw typically occurs when developers fail to implement proper authorization checks before granting access to sensitive resources or functionality.

Root Cause

The root cause of this vulnerability is the absence of proper authorization validation in the /dispatch/api?cmd=userinfo endpoint. The application appears to process requests to this endpoint without verifying whether the requester has legitimate credentials or sufficient privileges to access user information. This represents a fundamental failure in the access control implementation.

Attack Vector

The attack can be initiated remotely over the network. An attacker can send HTTP requests directly to the vulnerable API endpoint without requiring authentication. The vulnerability is publicly disclosed with exploit information available, making it particularly important for organizations to apply mitigations quickly.

The attack flow typically involves:

1. Attacker identifies the target system running Rongzhitong Visual Integrated Command and Dispatch Platform
2. Attacker sends a crafted HTTP request to /dispatch/api?cmd=userinfo
3. The server processes the request without proper authorization checks
4. Sensitive user information is returned to the attacker

For technical details and proof-of-concept information, refer to the GitHub CVE PoC Document.

Detection Methods for CVE-2026-2667

Indicators of Compromise

• Unusual or unauthorized requests to /dispatch/api?cmd=userinfo from external IP addresses
• High volume of API requests to the userinfo endpoint from a single source
• Access to user information endpoints from IP addresses outside the organization's expected range
• Failed authentication attempts followed by successful access to the vulnerable endpoint

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on requests to /dispatch/api?cmd=userinfo without valid authentication headers
• Configure intrusion detection systems (IDS) to flag unusual patterns of API access to dispatch endpoints
• Review application logs for requests to the affected endpoint that bypass authentication
• Deploy network monitoring to identify reconnaissance activity targeting the platform's API endpoints

Monitoring Recommendations

• Enable verbose logging on the Rongzhitong platform to capture all API requests including source IP and authentication status
• Set up real-time alerts for any access to sensitive endpoints from unauthenticated sessions
• Monitor for enumeration patterns that may indicate attackers probing for additional vulnerabilities
• Regularly audit access logs for the /dispatch/api endpoints to identify anomalous access patterns

How to Mitigate CVE-2026-2667

Immediate Actions Required

• Restrict network access to the affected endpoint using firewall rules to limit exposure to trusted networks only
• Implement authentication requirements for the /dispatch/api?cmd=userinfo endpoint at the web server or reverse proxy level
• Review and audit all API endpoints for similar access control vulnerabilities
• Consider taking the affected platform offline if sensitive data exposure is a concern until a patch is available

Patch Information

The vendor (Rongzhitong) was contacted regarding this vulnerability but did not respond. At the time of this publication, no official patch is available. Organizations should implement the workarounds and mitigations described below while monitoring for vendor updates.

For additional information, refer to:

• VulDB Entry #346464
• VulDB CTI ID #346464

Workarounds

• Deploy a reverse proxy or web application firewall (WAF) in front of the application to enforce authentication on all API endpoints
• Implement network segmentation to limit access to the platform from only authorized internal networks
• Use IP allowlisting to restrict access to the dispatch API to known trusted sources
• Disable or remove the vulnerable endpoint if the userinfo functionality is not critical to operations

# Example nginx configuration to require authentication
location /dispatch/api {
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://backend_server;
}