A flaw in the getTenantId function of ZS-Admin’s MyBatis‑Plus Tenant Plugin allows an attacker to manipulate the X‑Tenant‑Id request header and bypass authorization checks. The vulnerability is limited to the /api/system/sys/dept/page endpoint but can be triggered from any remote client that can send HTTP requests. If successful the attacker could potentially retrieve or manipulate data belonging to other tenants, compromising confidentiality and integrity of tenant data. This vulnerability stems from weak access control (CWE-285) and improper authorization (CWE-639).

The affected product is zsadmin2025 ZS‑Admin. No specific version numbers are disclosed, as the project uses a rolling‑release model and does not publish formal release tags. The vulnerability exists in any release up to the commit b52e14536d59fda11e56e2536a1c32e82a38cead.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be exploited remotely by crafting an HTTP request that sets the X‑Tenant‑Id header to an arbitrary value, thereby gaining unauthorized access to resources under that tenant identifier. An exploit is publicly available, indicating that attackers can readily use the vulnerability.