Quick answers
- Is CVE-2026-88617 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-88617 being exploited in the wild.
- How severe is CVE-2026-88617?
- Critical severity, with a CVSS score of 9.8, published 15 September 2026.
- Which products and versions are affected?
- 1024-Lab SmartAdmin 3.30.0.
- Is there a fix for CVE-2026-88617?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-88617 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-88617?
- Check whether you run 1024-Lab SmartAdmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
SmartAdmin v3.30.0 contains an authorization flaw in the /support/config/queryByKey endpoint (ConfigController.java) that fails to properly validate access control. A low-privileged authenticated user can query the super_password configuration key and retrieve its plaintext value from the t_config database table. The vulnerability combines configuration disclosure with a second weakness: the login service accepts this super_password as a universal authentication credential that bypasses email verification code requirements, allowing account takeover of any administrator. Attack requires valid low-privileged employee credentials and knowledge of an administrator's login name. Patches should restrict configuration access to authorized administrators, remove the universal password authentication mechanism, and rotate exposed secrets.
Affected products
- 1024-lab SmartAdmin 3.30.0
Timeline
- 2026-09-15: disclosed