CVE-2026-108923
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-266, CWE-284
Impact
Authenticated remote attackers can bypass access controls to read, modify, or impact availability of configuration data. They only need low-privileged network access to the application.
Root cause
Improper access control and privilege assignment in the /support/config/queryByKey endpoint when handling the configKey parameter.
Affected systems
1024-lab smart-admin up to 3.30.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official fixed version is available yet. Block network access to the /support/config/queryByKey endpoint or restrict it via WAF/reverse proxy to trusted administrator IPs.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.