Executive brief
SmartAdmin API is a rapid development platform used to build enterprise business applications. A flaw in the /employee/queryAll endpoint allows authenticated employees with low privileges to bypass authorization controls and retrieve sensitive employee records (names, phone numbers, emails, department info, admin flags) belonging to other departments and users without permission.
Technical details
The vulnerability is a missing authorization (CWE-862) in the EmployeeController.queryAllEmployee method in SmartAdmin API Java17 SpringBoot3 version 3.30.0. The GET /employee/queryAll endpoint fails to enforce function-level permissions and data-scope authorization checks, allowing any authenticated user to retrieve the full employee list regardless of their assigned department or role. An attacker with a valid low-privileged employee session token can make a remote request to the endpoint and receive sensitive employee records including login names, real names, telephone numbers, departments, positions, email addresses, and administrator flags. No patch information is currently available; remediation requires enforcing department and user data scope constraints and applying equivalent checks to related methods such as getAllEmployeeByDepartmentId.
Affected products
- 1024-lab SmartAdmin API Java17 SpringBoot3 3.30.0
Timeline
- 2026-09-15: disclosed
- 2026-09-15: advisory: CVE-2026-88620 published