zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111355 · Microsoft / collected KEV context

cve-program · CVE-2026-111355

• https://hackmd.io/@hieuPenguinnn/zhontai-admin-core-by-id-missing-data-scope-cross-dept
• https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L118-L144
• https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L595-L636
• https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L887-L900
• https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L977-L1000
• https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/Org/OrgService.cs#L64-L68
• https://www.vulncheck.com/advisories/zhontai-admin-core-through-10.1.0-authorization-bypass-via-user-and-organization-by-id-endpoints

No related operational record is retained in the current change model.