1024-lab smart‑admin versions up to 3.30.0 contain an access‑control flaw in the Demo Site component. A client can manipulate requests to the /smart-admin‑api/druid/index.html file and bypass intended restrictions, allowing an attacker to view or interact with protected content without proper authorization. The flaw originates from an unknown function within that path and violates multiple authorization primitives, aligning with CWE‑266 and CWE‑284 weaknesses.

The vulnerable product is 1024‑lab smart‑admin, specifically any release through 3.30.0. The flaw is tied to the Demo Site’s index.html endpoint located in the smart‑admin‑api/druid directory. All deployments of these versions that expose the index.html endpoint are susceptible, regardless of environment or deployment size.

The CVSS score of 6.9 places this issue in the medium severity range, and its EPSS score is not published, indicating insufficient data to assess real‑world exploitation probability. The vulnerability can be triggered remotely by an attacker who can reach the demo site endpoint. Because it is listed outside the CISA KEV catalog, it is not known to be actively exploited, but the lack of a vendor fix still poses a risk. The exploitation path requires reaching the index.html endpoint, and there are no known authentication or network barriers preventing an attacker from attempting the manipulation.