CVE-2026-7468
Full vulnerability record from the local CVENow database.
Description
A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0. This affects an unknown function of the file /smart-admin-api/druid/index.html of the component Demo Site. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
MEDIUM
CVSS score
5.5
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-04-30 01:16:03.170000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-7468",
"sourceIdentifier": "[email protected]",
"published": "2026-04-30T01:16:03.170",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0. This affects an unknown function of the file /smart-admin-api/druid/index.html of the component Demo Site. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Una vulnerabilidad de seguridad ha sido detectada en 1024-lab smart-admin hasta la versión 3.30.0. Esto afecta a una función desconocida del archivo /smart-admin-api/druid/index.html del componente Demo Site. La manipulación conduce a controles de acceso inadecuados. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado públicamente y puede ser utilizado. El proyecto fue informado del problema con antelación a través de un informe de incidencias, pero aún no ha respondido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "1024-lab",
"product": "smart-admin",
"modules": [
"Demo Site"
],
"versions": [
{
"version": "3.0",
"status": "affected"
},
{
"version": "3.1",
"status": "affected"
},
{
"version": "3.2",
"status": "affected"
},
{
"version": "3.3",
"status": "affected"
},
{
"version": "3.4",
"status": "affected"
},
{
"version": "3.5",
"status": "affected"
},
{
"version": "3.6",
"status": "affected"
},
{
"version": "3.7",
"status": "affected"
},
{
"version": "3.8",
"status": "affected"
},
{
"version": "3.9",
"status": "affected"
},
{
"version": "3.10",
"status": "affected"
},
{
"version": "3.11",
"status": "affected"
},
{
"version": "3.12",
"status": "affected"
},
{
"version": "3.13",
"status": "affected"
},
{
"version": "3.14",
"status": "affected"
},
{
"version": "3.15",
"status": "affected"
},
{
"version": "3.16",
"status": "affected"
},
{
"version": "3.17",
"status": "affected"
},
{
"version": "3.18",
"status": "affected"
},
{
"version": "3.19",
"status": "affected"
},
{
"version": "3.20",
"status": "affected"
},
{
"version": "3.21",
"status": "affected"
},
{
"version": "3.22",
"status": "affected"
},
{
"version": "3.23",
"status": "affected"
},
{
"version": "3.24",
"status": "affected"
},
{
"version": "3.25",
"status": "affected"
},
{
"version": "3.26",
"status": "affected"
},
{
"version": "3.27",
"status": "affected"
},
{
"version": "3.28",
"status": "affected"
},
{
"version": "3.29",
"status": "affected"
},
{
"version": "3.30.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-30T13:11:42.137522Z",
"id": "CVE-2026-7468",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"references": [
{
"url": "https://github.com/1024-lab/smart-admin/",
"source": "[email protected]"
},
{
"url": "https://github.com/1024-lab/smart-admin/issues/117",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/804228",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/360204",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/360204/cti",
"source": "[email protected]"
}
]
}