---
id: CVE-2026-121543
title: >-
  smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables
  Admin Escalation
summary: >-
  smart-sso through 2.0.1 contains an incorrect authorization vulnerability in
  PermissionFilter that allows any authenticated user to call admin console APIs
  because unlisted paths are permitted by default. Attackers can call
  /admin/user-r…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-863
vendor: a466350665
product: smart-sso
affected:
  - smart-sso <= 2.0.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T17:48:39.162182Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:28:09.427Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121543'
references:
  - url: 'https://github.com/a466350665/smart-sso/issues/79'
    label: 'GitHub Issue #79'
  - url: 'https://github.com/a466350665/smart-sso'
  - url: 'https://github.com/a466350665/smart-sso/commit/9bccabaa5ec5'
    label: Fix commit
  - url: >-
      https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-starter/smart-sso-starter-client/src/main/java/openjoe/smart/sso/client/filter/PermissionFilter.java#L38-L47
  - url: >-
      https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserRoleController.java
  - url: >-
      https://github.com/a466350665/smart-sso/commit/a74a791bea7fc7b06ce95f52ce5805d8d7886d48
  - url: >-
      https://www.vulncheck.com/advisories/smart-sso-through-2.0.1-incorrect-authorization-in-permissionfilter-enables-admin-escalation
    label: >-
      VulnCheck Advisory: smart-sso through 2.0.1 Incorrect Authorization in
      PermissionFilter Enables Admin Escalation
tags:
  - cve.org
epss: 0.00486
epssPercentile: 0.42136
ingestedAt: '2026-11-05T20:33:06.353Z'
---

## Overview

smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.

## Affected

- `smart-sso <= 2.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.