Is CVE-2026-16450 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16450 being exploited in the wild.

How severe is CVE-2026-16450?

Medium severity, with a CVSS score of 4.3, published 21 July 2026.

Which products and versions are affected?

Zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead.

Is there a fix for CVE-2026-16450?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16450 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16450?

Check whether you run Zsadmin2025 ZS-Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16450: zsadmin2025 ZS-Admin authorization bypass in MyBatis-Plus Tenant Plugin

CVE-2026-16450 · Severity: medium · CVSS 4.3 · Published 2026-07-21

A security flaw was found in ZS-Admin, a management framework that uses a multi-tenant architecture to keep different customers' data separate. Due to a failure in how the system verifies user identity, an attacker with a valid account could potentially access or modify data belonging to other organizations (tenants) by simply changing a header in their web request. This breaks the fundamental isolation between different customers using the same service.

Technologies: Zsadmin2025 ZS-Admin. Vendors: Zsadmin2025.

Quick answers

Is CVE-2026-16450 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16450 being exploited in the wild.
How severe is CVE-2026-16450?: Medium severity, with a CVSS score of 4.3, published 21 July 2026.
Which products and versions are affected?: Zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead.
Is there a fix for CVE-2026-16450?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16450 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16450?: Check whether you run Zsadmin2025 ZS-Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in ZS-Admin up to commit b52e14536d59fda11e56e2536a1c32e82a38cead. The vulnerability stems from the `TenantInterceptor` component, which populates the `TenantContext` using the client-provided `X-Tenant-Id` HTTP header or query parameter without validating it against the authenticated user's actual tenant assignment. This unverified ID is subsequently used by the `MultiTenantHandler` to inject tenant conditions into SQL queries. A remote authenticated attacker can exploit this by supplying a different tenant ID to perform cross-tenant data reads and potentially unauthorized data modifications. As of the advisory date, the project has not yet released a formal patch.

Affected products

zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead

Timeline

2026-06-15: disclosed: Issue reported to the project maintainers via GitHub
2026-07-21: advisory: CVE published by NVD/VulDB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.