CVE-2026-16450 zsadmin2025 CVE debrief

Who should care

Defenders responsible for zsadmin2025 ZS-Admin deployments should assess exposure to the vulnerable component and verify the presence of affected versions in their inventory. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should prioritize verifying the presence of affected versions in their inventory and assessing exposure to the vulnerable component to mitigate potential authorization bypass.

• Potential authorization bypass
• Need to verify presence of affected versions in inventory
• Need to assess exposure to vulnerable component

Technical summary

The vulnerability affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. Manipulation of the argument X-Tenant-Id leads to authorization bypass. The vulnerability allows attackers to bypass authorization, potentially leading to unauthorized access or modifications. The product utilizes a rolling release system for continuous delivery, making it challenging to determine the exact versions affected.

Defensive priority

Defenders should prioritize verifying the presence of affected versions in their inventory and assessing exposure to the vulnerable component.

Recommended defensive actions

• Verify the presence of affected versions in inventory
• Assess exposure to the vulnerable component
• Implement compensating controls to mitigate potential authorization bypass
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The exploit is publicly available and might be used. There is limited information available about the specific versions affected, as the product utilizes a rolling release system for continuous delivery. Defenders should verify the presence of affected versions in their inventory and assess exposure to the vulnerable component.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.