CVE-2026-111723 is a high severity (CVSS 8.8) missing authorization flaw in LingGuo-Drama through commit 8a6924a. Any registered user can call the admin accounts API, read password hashes, reset the bootstrap admin's password and raise their own authority. The record names no fixed version.
What's affected
LingGuo-Drama through commit 8a6924a, per the record and VulnCheck. It is tracked by commit rather than release. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The admin accounts API at /admin/v1/admins is guarded only by a JWT check that confirms a valid token, not an admin role. Self registration therefore gives an attacker the access the record describes.
Scoring note: the record's 8.8 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.7 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Identify the commit your deployment was built from. Then review the admin accounts list for entries you did not create and for accounts whose authority level changed.
Check whether the bootstrap administrator's password still works for the person who owns it. A reset would lock them out, which is an early sign of takeover.
What to do now
- Find each deployment and its commit.
- Disable open self registration until the flaw is fixed.
- Review all accounts and authority levels and remove unknown accounts.
- Reset the bootstrap admin password and invalidate existing tokens.
- Treat bcrypt hashes as exposed and force password changes for staff.
- Check the repository for a commit that adds role checks, then rebuild from it.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Do not stop at one host. Write down every place the affected software runs, including test servers, forgotten containers and copies bundled inside other products. Then rank them by exposure: anything reachable from the internet comes first, internal systems next. A short inventory now saves hours when the next advisory lands.
Why it matters
This is CWE-862, missing authorization. The route verifies that someone is logged in, which is authentication, and stops there. It never asks whether that someone is an administrator. A registered shopper and a site owner reach the same code.
The result is a full privilege escalation with confidentiality, integrity and availability all rated high. Hash exposure also gives attackers material for offline cracking. It is not listed in CISA KEV.
Quick check
Is a bcrypt hash safe to leak?
It is harder to crack than a plain hash, but weak passwords can still fall to offline guessing.
What is the quickest mitigation?
Turn off open registration and block the admin API from non admin users at the proxy.
Sources
Last reviewed: 18 October 2026.
