The vulnerability in cool-admin-midway allows a department‑limited administrator to perform privileged user management operations on accounts belonging to other departments. By passing arbitrary user identifiers to the /admin/sys/user/info, update, or delete endpoints, the attacker can read sensitive user data, reset passwords, change roles, and even delete accounts. This unauthorized manipulation of user accounts directly compromises confidentiality, integrity, and availability of the system’s user resources. The weakness is classified as an authorization bypass, corresponding to CWE‑639.

Vendor: Cool Team Official. Product: Cool Admin Midway, impacted versions up to and including 8.0.0. No newer versions are explicitly listed as fixed in the CVE data.

The CVSS score of 8.6 indicates a high severity threat. The EPSS score of < 1% indicates a very low exploitation probability, but the attack requires only authenticated sys:user:* permissions, which are commonly granted to administrators. The vulnerability is not listed in the CISA KEV catalog. An attacker with the necessary permissions can directly exploit the exposed endpoints to bypass departmental boundaries.