CVE-2026-110105

B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging.