A vulnerability exists in the smart-admin component of 1024‑lab up to version 3.30.0 that allows an attacker to manipulate the configuration key parameter in the /support/config/queryByKey endpoint. This manipulation bypasses the intended authorization controls and permits the execution of arbitrary configuration queries. The result is unauthorized disclosure or modification of sensitive system settings, potentially affecting the confidentiality and integrity of the application. The weakness is represented by the CWE-266 and CWE-284 identifiers, indicating improper privilege escalation and inadequate access control, respectively.

The affected product is 1024‑lab smart‑admin, any deployed instance whose version is 3.30.0 or earlier. No specific sub‑versions are listed; the known vulnerable range is simply identified as up to 3.30.0. Users running other, newer releases are presumed not impacted unless a future advisory indicates otherwise.

The CVSS score of 5.3 places this issue in the medium severity range. EPSS data was not provided, but the advisory notes that the exploit has been publicly disclosed and may be used, implying a realistic threat window. The attack can be carried out remotely, most likely through a network request to the affected endpoint. Because the vulnerability allows privileged access to configuration data, an attacker could compromise system stability or cause service disruption. The vulnerability is not yet listed in the CISA KEV catalog, but the combination of its medium CVSS score, public availability of exploits, and remote nature warrants prompt action.