Description
A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a manipulation of the argument ID results in information disclosure. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-01-20
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The identified issue resides in the /system/downloadById endpoint of MineAdmin 1.x and 2.x. By manipulating the ID argument, a caller can trigger the download of files that were not intended for public disclosure, leading to the leaking of potentially sensitive data. This flaw falls under the Information Exposure and Improper Access Control weaknesses.

Affected Systems

MineAdmin versions 1.0 and 2.0, along with any 1.x and 2.x releases, are impacted by this vulnerability.

Risk and Exploitability

The vulnerability has a low CVSS score of 2.3 and an EPSS score below 1 %, indicating a low overall severity and a very small probability of exploitation in the wild. Nonetheless, the attack can be initiated remotely, requires high complexity and is considered difficult to exploit, yet the public exploit may be leveraged by an attacker with network access to the MineAdmin instance. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Generated by OpenCVE AI on April 16, 2026 at 07:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Implement role‑based access control for the /system/downloadById endpoint so that only authorized users can request downloads.
  • Validate and sanitize the ID parameter to ensure it refers only to resources that the user is permitted to access.
  • Restrict network access to the MineAdmin service via firewalls or VPN so that only trusted hosts can reach the application.

Generated by OpenCVE AI on April 16, 2026 at 07:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 09:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:mineadmin:mineadmin:*:*:*:*:*:*:*:*

Thu, 05 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:mineadmin:mineadmin:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mineadmin:mineadmin:2.0:*:*:*:*:*:*:*

Tue, 20 Jan 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Jan 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Mineadmin
Mineadmin mineadmin
Vendors & Products Mineadmin
Mineadmin mineadmin

Tue, 20 Jan 2026 00:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a manipulation of the argument ID results in information disclosure. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title MineAdmin downloadById information disclosure
Weaknesses CWE-200
CWE-284
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mineadmin Mineadmin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-25T12:33:15.548Z

Reserved: 2026-01-19T14:00:03.326Z

Link: CVE-2026-1197

cve-icon Vulnrichment

Updated: 2026-01-20T17:03:19.109Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-20T01:15:56.620

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-1197

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T08:00:11Z

Weaknesses