CVE Feed

    Dashboard / CVE / CVE-2026-110105

    CVE-2026-110105

    B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging.

    Published:Oct 13, 2026
    Last Modified:Oct 26, 2026
    EPS:Oct 13, 2026
    EPSS Score:0.00295
    CVSS Score:5.3

    Affected Products

    Vendor
    B3log
    Product
    Symphony

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2024-23049 (CVSS 9.8) — An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j compo…
    CVE-2019-17488 (CVSS 6.1) — b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.…
    CVE-2018-16249 (CVSS 4.8) — In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the…
    CVE-2019-9142 (CVSS 6.1) — An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickna…
    CVE-2018-10469 (CVSS 9.8) — b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[…
    CVE-2017-16821 (CVSS 5.4) — b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High