CVE-2026-75339

cjbi admin3 v3.0.0 fails to enforce permission checks (CWE-862, missing authorization) on its /storage/upload endpoint. Any authenticated, logged-in user can upload arbitrary files through this endpoint regardless of their assigned role, while the corresponding download path requires no authentication at all, allowing anonymous attackers to retrieve uploaded files. A low-privilege account can therefore plant arbitrary or potentially executable content on the server, and unauthenticated users gain unauthorized read access to whatever has been stored. Any deployment of admin3 v3.0.0 that exposes the storage endpoints over the network is affected. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only about a 0.3% chance of exploitation in the next 30 days.

What to do: Verify the deployed admin3 version and upgrade to a patched release once one is available, since the advisory only names v3.0.0 as affected. As an interim mitigation, restrict /storage/upload and the anonymous download route at the reverse proxy (authentication or IP allowlisting), keep uploaded files out of web-executable paths, and check logs for uploads by unexpected accounts or anonymous downloads of stored files.