CVE-2026-111355 zhontai CVE debrief

Who should care

Defenders responsible for authentication and authorization control assessments, particularly those managing user and organization module permissions in zhontai Admin.Core deployments, should assess exposure and verify version 10.1.0 or earlier for potential vulnerabilities.

Why it matters

CVE-2026-111355 is a medium-severity authorization bypass vulnerability in zhontai Admin.Core through 10.1.0. Defenders should assess exposure, particularly for those managing user and organization module permissions, and verify current version implementation.

• Potential unauthorized access to sensitive user and organization data
• Possible modification or deletion of user accounts outside of assigned department scope
• Risk of privilege escalation for attackers with user or organization module permissions
• Need for verification of current version and implementation of compensating controls

Technical summary

The zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability allowing authenticated users to ignore department DataScope restrictions. Attackers with user or organization module permissions can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments. This vulnerability has a medium severity and defenders should assess exposure, particularly for those managing user and organization module permissions, and verify current version implementation.

Defensive priority

Medium priority for authentication and authorization control assessments

Recommended defensive actions

• Review authentication and authorization controls for UserService and OrgService by-id methods
• Assess Dept and Self scope restrictions for user and organization module permissions
• Verify version 10.1.0 or earlier of zhontai Admin.Core for potential exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program and NVD records provide details on the authorization bypass vulnerability in zhontai Admin.Core through 10.1.0. Supplemental sources offer technical descriptions and third-party advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.