CVE-2026-88619

1024-lab SmartAdmin v3.30.0 ships a scheduled-job management controller (AdminSmartJobController) whose endpoints lack method-level permission checks, creating a missing authorization flaw (CWE-862). Any authenticated user with low privileges can send requests directly to these admin-only endpoints to view, create, modify, or trigger scheduled jobs. Because scheduled-job configuration and execution typically expose sensitive system details and powerful administrative actions, an attacker gains high confidentiality and integrity impact (CVSS 3.1: 8.1) within the application, with no availability impact. Organizations running SmartAdmin v3.30.0 with untrusted or multi-role user accounts are affected. No public proof of concept is known and there is no evidence of in-the-wild exploitation to date.

What to do: Upgrade SmartAdmin to a version newer than 3.30.0 as soon as the vendor ships a fix, since no patched version is confirmed in the advisory. In the interim, restrict access to the scheduled-job endpoints (e.g., gateway or URL-based rules limiting AdminSmartJobController paths to administrator roles) and review application logs for non-admin accounts that have touched those endpoints or modified job definitions.