Unrated severityNVD Advisory· Published Sep 15, 2026
CVE-2026-88620
CVE-2026-88620
Description
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: =3.30.0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.