A missing authorization check in the /admin/v1/admins API allows any registered user to manage all user accounts. The API is protected only by an AuthAdminJWT token, which does not verify the user's authority level. As a result, an attacker can read all account bcrypt hashes, reset the bootstrap administrator's password, elevate their own authority_id, and delete accounts. This grants full control over the system and enables compromise of privileged accounts. The vulnerability is a classic missing authority check (CWE-862).

The vulnerability affects LingGuoAI's LingGuo-Drama application, specifically the authentication and admin management code present in the commit 8a6924a. No specific version numbers are provided, so any deployment of LingGuo-Drama that contains this commit without a later fix is vulnerable.

The CVSS score of 8.7 indicates a high severity, classifying the flaw as a major threat to confidentiality, integrity, and availability. The EPSS score is not available, so the exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, but the potential for account takeover and privilege escalation remains significant, especially if registration is open or easily exploited. Attackers can leverage the API by simply acquiring a JWT for a registered user, which is a straightforward prerequisite. The risk remains high until a remedial patch or adequate authorization layer is applied.