CVE-2026-110105

Executive Summary

CVE-2026-110105 is a missing authorization vulnerability in B3log Symphony (a Java-based community forum / blogging platform) through version 3.6.4. The authorization middleware component PermissionMidware.check permits requests to routes that lack a permission.rule.url entry, meaning any route not explicitly covered by a permission rule is reachable without authentication. This allows unauthenticated attackers to invoke administrative endpoints, including /admin/report/ignore/{reportId}, /admin/tags/remove-unused, and /admin/user/{userId}/init-point, enabling unauthorized state changes and — per the description — operations that occur without audit logging.

Technical Analysis

Symphony is a community/forum software built on a Java servlet-style middleware chain. Enforcement of access control is delegated to a middleware named PermissionMidware, which inspects the requested route against configured permission rules. The vulnerability (CWE-862, Missing Authorization) arises from the default-branch logic in PermissionMidware.check: when a route has no matching permission.rule.url entry, the middleware treats the route as permitted rather than denied. This is a fail-open authorization design. In a correct implementation, an unmatched route should default to "deny" (fail-closed); instead, the absence of a rule equates to "allow."

The attack surface is the HTTP request routing layer exposed to the network. Because the three cited administrative endpoints (/admin/report/ignore/{reportId}, /admin/tags/remove-unused, /admin/user/{userId}/init-point) are not covered by permission.rule.url entries, the middleware does not block unauthenticated access to them. An attacker requires only network reachability to a Symphony instance; no credentials or session tokens are needed.

The reported impact is integrity-focused (CVSS I:L) because the endpoints perform state-changing operations: ignoring abuse reports, deleting unused tags, and granting points to a user. Confidentiality and availability impacts are not credited by the CVSS vector. The description explicitly notes that these actions occur without audit logging, which removes a key forensic control and increases the difficulty of post-incident detection. Note that the specific internal code path, exact permission-configuration format, and the full enumeration of affected routes beyond the three named examples are not detailed in the available description; the analysis above is limited to what is stated.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (missing authorization / fail-open routing) and the endpoints named in the NVD description. No public PoC, Nuclei template, or exploit code is available.

1. Reconnaissance / target identification. The attacker identifies internet- or network-exposed B3log Symphony instances (e.g., via Shodan dorks targeting the Symphony login/landing page). No authentication is required for the reconnaissance phase beyond confirming the product and version.

2. Triggering the flaw class. Because PermissionMidware.check permits routes without a permission.rule.url entry, the attacker sends unauthenticated HTTP requests directly to administrative routes rather than to the login flow. The fail-open behavior of the middleware means the request is not rejected at the authorization layer.

3. Payload / execution (class level). The attacker issues requests to the exposed admin endpoints named in the description:

   • GET/POST /admin/report/ignore/{reportId} — no valid session required; the endpoint proceeds to ignore the specified report.
   • GET/POST /admin/tags/remove-unused — removes unused tags without an authenticated admin context.
   • GET/POST /admin/user/{userId}/init-point — grants points to the specified user. The exact HTTP method and parameter semantics are not specified in the source data and are therefore not asserted here.

4. Post-exploitation impact. The attacker performs unauthorized administrative state changes without authentication and without audit logging. Because operations are unlogged, subsequent forensic reconstruction is impaired. The description does not indicate that these endpoints permit further privilege escalation, code execution, or data exfiltration; those follow-on effects are not asserted.

Impact Assessment

The CVSS base score is 5.3 (Medium): AV:N (remote), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction), S:U (scope unchanged), C:N (no confidentiality impact), I:L (low integrity impact), A:N (no availability impact). The blast radius is any network-reachable Symphony instance through 3.6.4 that relies on the affected middleware for admin-route protection.

From a business perspective, the primary risks are unauthorized modification of platform state (report handling, tag management, user point balances) and the loss of an audit trail for those changes. The absence of audit logging undermines integrity guarantees and accountability, and can enable abuse of moderation and gamification features (e.g., illicitly granting points, suppressing abuse reports). Confidentiality and availability are not directly impacted per the vector, so data theft or denial-of-service are not credited by this CVE. The EPSS score is 0.00295 (20.7th percentile), indicating low predicted exploitation likelihood in the near term; the CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: B3log Symphony Unauthenticated Admin Route Access (CVE-2026-110105)
id: 9f1e7c2a-3b4d-4e8a-9c11-7a2f0d5b6e01
status: experimental
description: Detects unauthenticated or anonymous requests to Symphony admin endpoints affected by missing authorization (PermissionMidware fail-open).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110105
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_route:
    cs-uri-stem|contains:
      - '/admin/report/ignore/'
      - '/admin/tags/remove-unused'
      - '/admin/user/'
  selection_initpoint:
    cs-uri-stem|contains: '/init-point'
  selection_anon:
    cs-username:
      - ''
      - '-'
  condition: (selection_route or selection_initpoint) and selection_anon
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - cs-username
falsepositives:
  - Legitimate authenticated admin sessions where username is not logged
level: high

YARA Rule

rule CVE_2026_110105_Symphony_PermissionMidware
{
    meta:
        description = "Detects B3log Symphony code/config referencing admin routes lacking permission.rule.url entries (CVE-2026-110105)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110105"
        date = "2026-01-01"

    strings:
        $mw     = "PermissionMidware" ascii
        $chk    = "check" ascii
        $rule   = "permission.rule.url" ascii
        $r1     = "/admin/report/ignore/" ascii
        $r2     = "/admin/tags/remove-unused" ascii
        $r3     = "/init-point" ascii

    condition:
        $mw and $chk and ($rule or any of ($r*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110105 B3log Symphony Unauthenticated Admin Route Access"; flow:established,to_server; http.uri; content:"/admin/report/ignore/"; nocase; sid:2026110101; rev:1;)
alert http any any -> any any (msg:"CVE-2026-110105 B3log Symphony Admin Tag Delete Attempt"; flow:established,to_server; http.uri; content:"/admin/tags/remove-unused"; nocase; sid:2026110102; rev:1;)
alert http any any -> any any (msg:"CVE-2026-110105 B3log Symphony Admin Init-Point Grant Attempt"; flow:established,to_server; http.uri; content:"/admin/user/"; http.uri; content:"/init-point"; nocase; sid:2026110103; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method in ("GET","POST")
      and wildcard(http.request.uri, "/admin/report/ignore/*") ]
  [ network where http.request.method in ("GET","POST")
      and wildcard(http.request.uri, "/admin/tags/remove-unused") ]

Alternative single-event form:

network where wildcard(http.request.uri, "/admin/user/*/init-point")
   or wildcard(http.request.uri, "/admin/report/ignore/*")
   or http.request.uri == "/admin/tags/remove-unused"

Splunk SPL Query

index=web
| eval uri=coalesce(uri, cs_uri_stem, url)
| where match(uri, "(?i)/admin/report/ignore/") OR match(uri, "(?i)/admin/tags/remove-unused") OR (match(uri, "(?i)/admin/user/") AND match(uri, "(?i)/init-point"))
| eval authenticated=if(isnull(user) OR user="" OR user="-", "ANON", user)
| where authenticated="ANON"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-110105,">
  <rule id="202611010" level="12">
    <if_sid>31100</if_sid>
    <match>admin/report/ignore/|admin/tags/remove-unused|/init-point</match>
    <description>CVE-2026-110105: B3log Symphony unauthenticated access to admin route detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict network access to Symphony administrative routes at the reverse proxy / WAF / firewall layer — deny external access to /admin/* except from trusted management networks or authenticated sessions. Configure explicit deny-by-default rules so that any admin route not covered by a permission.rule.url entry is blocked. Because the affected middleware fails open, do not rely on it alone for these routes; enforce access control upstream. Ensure audit logging is enabled and retained.
2. Patch / upgrade steps. No vendor patch or fixed version is currently available. Monitor the B3log Symphony project for an updated release that corrects PermissionMidware.check to fail closed (deny unmatched routes) and that adds the missing permission.rule.url coverage for admin/user, admin/report, and admin/tags routes. Upgrade as soon as a fixed version is published; until then, treat all versions through 3.6.4 as affected.
3. Long-term hardening. Adopt fail-closed authorization design across all middleware. Enforce deny-by-default admin routing, implement mandatory authentication for every state-changing administrative endpoint, add centralized audit logging for all admin actions, and add regression tests that assert unauthenticated requests to admin routes return 401/403. Apply least privilege to the service, and periodically review route-to-permission coverage for gaps.

References

• NVD — CVE-2026-110105: https://nvd.nist.gov/vuln/detail/CVE-2026-110105
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• B3log Symphony project (vendor source / advisories): https://github.com/b3log/symphony (returned 404 — verify manually)
• CISA KEV Catalog (CVE-2026-110105 is NOT listed as of report generation): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or evidence of in-the-wild exploitation or named threat-actor campaigns was identified for this CVE in the provided data. EPSS is 0.00295 (20.7th percentile), indicating low predicted likelihood of exploitation.