zhontai Admin.Core versions up to 10.1.0 suffer a CWE-639 authorization bypass that allows authenticated users to ignore department data‑scope limits by supplying out‑of‑scope record IDs to UserService and OrgService by‑ID endpoints. An attacker holding User or Organization module permissions with Dept or Self scope can read, modify, disable, or delete users belonging to any department, effectively escalating privileges within the application.

The vulnerability is present in zhontai Admin.Core, specifically the 10.1.0 release. No other product versions are listed in the vendor information.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers need only valid credentials with limited Dept or Self scope and can invoke the affected endpoints to exploit the defect. Because the flaw permits cross‑department account manipulation, the potential impact on confidentiality, integrity, and availability is significant within the application scope.