CVE-2026-111366 cool-team-official CVE debrief

Who should care

System administrators and security teams responsible for cool-admin-midway deployments should assess their exposure and prioritize remediation. This vulnerability is particularly relevant for environments where user management is decentralized or where departmental boundaries are critical.

Why it matters

CVE-2026-111366 is a high-severity authorization bypass vulnerability in cool-admin-midway through version 8.0.0. It allows department-limited admins to manage users outside their departments, potentially leading to unauthorized user management actions, increased insider threat risk, and data breaches. Defenders should verify their version, restrict access to user management endpoints, and consider upgrading.

• Potential unauthorized user management actions
• Increased risk of insider threats or lateral movement
• Possible data breaches due to elevated access
• Need for verification of current version and exposure

Technical summary

The cool-admin-midway package through version 8.0.0 contains an authorization bypass vulnerability. This vulnerability allows users with department-limited admin permissions to manage users outside their departments by providing arbitrary user IDs. Specifically, attackers who hold sys:user:* permissions can use the /admin/sys/user/info, update, or delete endpoints to read records, reset passwords and roles, or delete accounts.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their environments, especially if they use cool-admin-midway version 8.0.0 or earlier.

Recommended defensive actions

• Verify the version of cool-admin-midway in use and assess exposure
• Restrict access to /admin/sys/user endpoints to authorized personnel
• Implement additional monitoring for suspicious activity on user management endpoints
• Consider upgrading to a version of cool-admin-midway beyond 8.0.0 if available
• Perform a thorough review of user management configurations to prevent unauthorized access
• Conduct regular security audits to identify and address potential vulnerabilities
• Document and track remediation efforts for future reference and compliance purposes

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and potential impacts. However, there is limited information about exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.