{"metadata": {"vulnerability": "CVE-2026-111723", "count": 12, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111723", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-16T14:33:31.388Z", "date_only": false, "value": "2026-10-16T14:33:31.388Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111723", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T17:40:09.757Z", "date_only": false, "value": "2026-10-16T17:40:09.757Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111723", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T17:40:09.757Z", "date_only": false, "value": "2026-10-16T17:40:09.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111723", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:40:09.757Z", "date_only": false, "value": "2026-10-16T17:40:09.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111723", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:56Z", "date_only": false, "value": "2026-10-16T18:17:56Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9GFR-R435-56MX", "record": "GHSA-9GFR-R435-56MX", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T18:17:56.980Z", "date_only": false, "value": "2026-10-16T18:17:56.980", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111723", "record": "FKIE_CVE-2026-111723", "field": "published"}, {"timestamp": "2026-10-16T18:34:57Z", "date_only": false, "value": "2026-10-16T18:34:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9GFR-R435-56MX", "record": "GHSA-9GFR-R435-56MX", "field": "published"}, {"timestamp": "2026-10-16T18:34:57Z", "date_only": false, "value": "2026-10-16T18:34:57Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9GFR-R435-56MX", "record": "GHSA-9GFR-R435-56MX", "field": "modified"}, {"timestamp": "2026-10-16T19:03:18.127Z", "date_only": false, "value": "2026-10-16T19:03:18.127", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111723", "record": "FKIE_CVE-2026-111723", "field": "lastModified"}, {"timestamp": "2026-10-16T19:09:12.068Z", "date_only": false, "value": "2026-10-16T19:09:12.068349Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452161085995780", "record": "CVE-2026-111723", "field": "creation_timestamp", "uuid": "d89b3db6-8939-4e1c-8f42-e1ad69009c63", "content": "CVE-2026-111723 LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111723https://hackmd.io/@hieuPenguinnn/lingguo-drama-broken-access-controlhttps://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/routes/admin.go#L244-L255https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/http/controllers/admin/v1/admins_controller.go#L166-L198https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/models/admins/admins.go#L14https://www.vulncheck.com/advisories/lingguo-drama-through-commit-8a6924a-broken-access-control-via-admin-v1-admins-api#LingGuoAI #LingGuo-Drama#CVE_2026_111723#bot", "url": "https://infosec.exchange/users/cve/statuses/117452161085995780"}, {"timestamp": "2026-10-17T04:00:06.322Z", "date_only": false, "value": "2026-10-17T04:00:06.322800Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3my27ci74ry2h", "record": "CVE-2026-111723", "field": "creation_timestamp", "uuid": "925197df-4734-4014-9b50-14996648a658", "content": "CVE-2026-111723 - lingguo-drama\nThe Lingguo Drama application\u2019s admin API does not properly check who is allowed to use it. As a result, any person who signs up can view every user\u2019s password data,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#lingguodrama #lingguoai #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3my27ci74ry2h"}]}