CVE-2026-111604eladmin through 2.7 Broken Access Control via /api/users Update and Delete
Updated under an hour ago ()
Does this affect you?
It affects elunez eladmin. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
- CVSS
- 3.8 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
- Weakness (CWE)
- CWE-639
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 16, 2026
Affected products
elunez eladmin elunez:eladmin (from the name) | through 2.7 | CNA record |
References
- https://hackmd.io/@hieuPenguinnn/eladmin-user-update-delete-missing-dept-data-scopethird-party-advisory
- https://github.com/elunez/eladmin/blob/v2.7/eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java#L118-L152technical-description
- https://github.com/elunez/eladminproduct
- https://www.vulncheck.com/advisories/eladmin-through-2.7-broken-access-control-via-api-users-update-and-deletethird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.