CVE-2026-16450

Name of the Vulnerable Software and Affected Versions zsadmin2025 ZS-Admin versions up to b52e14536d59fda11e56e2536a1c32e82a38cead

Description An authorization bypass exists in the MyBatis-Plus Tenant Plugin component. A remote attacker can manipulate the X-Tenant-Id argument within the getTenantId() function of the '/api/system/sys/dept/page' endpoint to bypass authorization controls.

Recommendations As a temporary workaround, restrict access to the '/api/system/sys/dept/page' endpoint or avoid using the X-Tenant-Id argument until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.