CVE-2026-111604
CVE-2026-111604 · eladmin through 2.7 Broken Access Control via /api/users Update and Delete
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
CVSS 5.1 · Media · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
eladmin
- Versiones
- ≥ 0, ≤ 2.7: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/eladmin-user-update-delete-missing-dept-data-scope
- https://github.com/elunez/eladmin/blob/v2.7/eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java#L118-L152
- https://github.com/elunez/eladmin
- https://www.vulncheck.com/advisories/eladmin-through-2.7-broken-access-control-via-api-users-update-and-delete
- https://nvd.nist.gov/vuln/detail/CVE-2026-111604