Executive brief
A security flaw was found in ZS-Admin, a management framework that uses a multi-tenant architecture to keep different customers' data separate. Due to a failure in how the system verifies user identity, an attacker with a valid account could potentially access or modify data belonging to other organizations (tenants) by simply changing a header in their web request. This breaks the fundamental isolation between different customers using the same service.
Technical details
An authorization bypass exists in ZS-Admin up to commit b52e14536d59fda11e56e2536a1c32e82a38cead. The vulnerability stems from the `TenantInterceptor` component, which populates the `TenantContext` using the client-provided `X-Tenant-Id` HTTP header or query parameter without validating it against the authenticated user's actual tenant assignment. This unverified ID is subsequently used by the `MultiTenantHandler` to inject tenant conditions into SQL queries. A remote authenticated attacker can exploit this by supplying a different tenant ID to perform cross-tenant data reads and potentially unauthorized data modifications. As of the advisory date, the project has not yet released a formal patch.
Affected products
- zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead
Timeline
- 2026-06-15: disclosed: Issue reported to the project maintainers via GitHub
- 2026-07-21: advisory: CVE published by NVD/VulDB