CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality intended for authorized administrators.

Scoring

Severity

HIGH

CVSS base score

8.1

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS probability

0.34%

Published

2026-09-15

Last modified

2026-09-15

Affected products

• n/a n/a

Markdown version · Browse all CVEs