CVE-2026-75339: cjbi admin3 Auth Bypass Vulnerability

CVE-2026-75339 Overview

CVE-2026-75339 is a missing authorization vulnerability in cjbi admin3 v3.0.0. The /storage/upload endpoint fails to enforce permission checks. Any authenticated user can upload arbitrary files to the application. Any anonymous attacker can subsequently download those files without authentication.

The flaw is tracked as CWE-862: Missing Authorization. Attackers can weaponize this weakness to plant malicious content, stage payloads, or exfiltrate data through an unauthenticated retrieval path.

Critical Impact

A low-privileged account can upload arbitrary file types, and unauthenticated attackers can download them, enabling malware staging, credential harvesting, and data exposure across affected admin3 deployments.

Affected Products

• cjbi admin3 v3.0.0
• Applications embedding the admin3 storage module
• Deployments exposing /storage/upload to authenticated users

Discovery Timeline

• 2026-08-28 - CVE-2026-75339 published to NVD
• 2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-75339

Vulnerability Analysis

The vulnerability resides in the /storage/upload endpoint of cjbi admin3 v3.0.0. The endpoint accepts file uploads from any authenticated session without validating role, scope, or object ownership. The corresponding download path also lacks authentication, allowing anonymous file retrieval.

This combination transforms the application into an open file-hosting service for anyone with a valid login. Because admin3 is an administrative framework often integrated with sensitive backends, attackers can abuse the endpoint to distribute payloads from a trusted origin.

Root Cause

The root cause is missing server-side authorization enforcement on the storage controller. The upload handler checks only that a session exists, not that the caller has permission to write to storage. The download handler performs no authentication or access-control check on the object identifier.

Attack Vector

An attacker first obtains any low-privileged account, either through self-registration, credential reuse, or a compromised user. The attacker then issues a multipart POST request to /storage/upload containing an arbitrary file, including executables, HTML, or scripts. The server stores the file and returns a URL. The attacker shares that URL with unauthenticated victims, who can retrieve the payload directly.

For technical proof-of-concept details, refer to the GitHub CVE PoC Repository.

Detection Methods for CVE-2026-75339

Indicators of Compromise

• Unexpected files in the admin3 storage directory owned by non-administrative users
• HTTP POST requests to /storage/upload from accounts that should not have upload permissions
• Anonymous GET requests retrieving files from storage paths with high download volume
• Uploaded files with executable extensions such as .jsp, .war, .html, or .svg

Detection Strategies

• Review web server access logs for POST requests to /storage/upload correlated with low-privilege session identifiers
• Alert on file writes to the admin3 storage directory with MIME types outside the expected allowlist
• Baseline normal upload volume per user and flag deviations exceeding two standard deviations
• Inspect downloaded files for embedded scripts, webshells, or phishing content using static analysis

Monitoring Recommendations

• Forward admin3 application and web server logs to a centralized analytics platform for correlation
• Monitor outbound links referencing the admin3 storage URL on external sites and messaging platforms
• Track new user registrations that immediately perform upload actions, indicating automated abuse

How to Mitigate CVE-2026-75339

Immediate Actions Required

• Restrict network access to /storage/upload using a reverse proxy or web application firewall rule until a patch is applied
• Disable self-service account registration on affected admin3 instances to limit the attacker population
• Audit the storage directory for unauthorized files and remove any content not tied to a legitimate business action
• Rotate credentials for accounts that show anomalous upload activity

Patch Information

No vendor patch has been published in the NVD record at the time of writing. Monitor the cjbi admin3 project repository for security releases beyond v3.0.0. Track the GitHub CVE PoC Repository for updates on fixes and mitigations.

Workarounds

• Enforce authentication on the download path by placing storage behind an authenticated proxy
• Implement a server-side allowlist restricting upload MIME types and file extensions
• Apply role-based access control to the upload controller so only administrative roles can write to storage
• Serve downloaded files with Content-Disposition: attachment and a restrictive Content-Security-Policy to reduce browser-side execution risk

# Example nginx configuration to require authentication on admin3 storage endpoints
location /storage/upload {
    auth_request /auth/validate;
    limit_except POST { deny all; }
    client_max_body_size 10m;
    proxy_pass http://admin3_backend;
}

location /storage/ {
    auth_request /auth/validate;
    proxy_pass http://admin3_backend;
}