MineAdmin Swagger information disclosure

Vulnerability

Overview

CVE-2026-1194 describes an information disclosure vulnerability in MineAdmin, MineAdmin, a PHP-based backend management system built on the Hyperf framework [2]. The flaw resides in the Swagger component, where an unknown function allows remote attackers to retrieve sensitive information without authentication [1]. The vendor was contacted but did not respond, and a public exploit has been released [1].

Attack

Vector and Exploitation

The vulnerability

The vulnerability can be triggered remotely by sending a GET request to the /swagger/http.json endpoint [3]. No authentication or special privileges are required, making the attack surface broad for any internet-facing MineAdmin instance. The exploit has been publicly disclosed, increasing the risk of widespread scanning and exploitation [1].

Impact

Successful exploitation leads to information disclosure, revealing the full Swagger API documentation. This includes endpoint paths, request parameters, response structures, and potentially internal system details [3]. An attacker can use this information to map the application's attack surface, identify other vulnerabilities, or craft targeted attacks against authenticated functions.

Mitigation

Status

As of publication, the vendor has not responded to the disclosure and no official patch or advisory has been released [1]. Users are advised to restrict access to the Swagger endpoint, implement authentication for API documentation, or disable Swagger in production environments. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.