CVE Intelligence

B3log Symphony vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting B3log Symphony: 1 record(s), with affected versions and fixes.

CVE-2026-110105 Medium · 5.3 CWE-862 Oct 13, 2026
B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging.