SmartAdmin up to version 3.30.0 contains a missing authorization flaw in AdminProtectController (CWE-862) that allows an authenticated user with low privileges to call unprotected endpoints such as updateConfig and loginFail batchDelete. By invoking these functions an attacker can disable login lockout, turn off two‑factor authentication, weaken password policies, and clear lockout records, effectively erasing the application’s security controls and creating convenient footholds for further exploitation.

The affected product is 1024‑lab: SmartAdmin, version 3.30.0 and earlier. No other vendors or products are listed.

A CVSS score of 7.1 labels this vulnerability as high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires only an authenticated account with low privileges; no special skills or elevated permissions are necessary. This makes the threat realistic for an insider or for an attacker who has compromised user credentials.