Is CVE-2026-110105 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110105 being exploited in the wild.

How severe is CVE-2026-110105?

Medium severity, with a CVSS score of 5.3, published 13 October 2026.

Is there a fix for CVE-2026-110105?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-110105 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110105?

Check whether you run B3log Symphony at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110105: B3log Symphony missing authorization in admin routes

CVE-2026-110105 · Severity: medium · CVSS 5.3 · Published 2026-10-13

B3log Symphony is a Java-based community platform (forum, Q&A, blog) that requires administrative authentication for sensitive operations. A missing authorization flaw allows unauthenticated attackers to reach admin functions like ignoring abuse reports, deleting tags, and granting user points, bypassing intended access controls and audit logging.

Vendors: B3log.

Quick answers

Is CVE-2026-110105 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110105 being exploited in the wild.
How severe is CVE-2026-110105?: Medium severity, with a CVSS score of 5.3, published 13 October 2026.
Which products and versions are affected?: B3log Symphony through 3.6.4.
Is there a fix for CVE-2026-110105?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-110105 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110105?: Check whether you run B3log Symphony at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The PermissionMiddleware improperly permits routes lacking permission.rule.url entries, allowing unauthenticated access to privileged endpoints. Attackers can directly invoke /admin/report/ignore/{reportId}, /admin/tags/remove-unused, and /admin/user/{userId}/init-point without authentication. This is a broken access control vulnerability in the routing/middleware layer affecting administrative functions.

Affected products

B3log Symphony through 3.6.4

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.