CVE-2026-111604

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604

The eladmin framework, versions through 2.7 , is vulnerable to an authorization bypass (CWE-639) within the /api/users endpoints. The root cause is that write handlers skip mandatory department checks , allowing department-scoped user managers to exceed their intended data scope. An attacker poss...

EUVD-2026-103026

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-111604: Authorization Bypass Through User-Controlled Key

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

EUVD-2026-102904

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-106705

The ELADMIN (eladmin-mp) framework, up to version 2.7 , is susceptible to an improper access control vulnerability within the role management module. Specifically, the PUT /api/roles/menu (RoleController.updateRoleMenu) endpoint fails to validate the granted menu set and does not prevent a caller...

PT-2026-116003

Name of the Vulnerable Software and Affected Versions eladmin versions prior to 2.8 Description An authorization bypass exists where department-scoped user managers can modify or delete accounts outside their assigned data scope. This occurs because write handlers fail to perform necessary...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-106705: Improper Access Control

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

PT-2026-115627

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-106700

ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs n...

CVE-2026-106701

ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...

eladmin authorization issue vulnerability

Eladmin versions 2.7 and earlier have an authorization issue vulnerability. This vulnerability stems from the write processing program skipping department checks, allowing unauthorized access. Attackers with the user:edit or user:del permissions can send PUT or DELETE requests to /api/users,...

eladmin Permission Authorization and Access Control Vulnerabilities

The eladmin 2.7 and earlier versions have vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper access control in the role management module. The PUT /api/roles/menu RoleController.updateRoleMenu endpoint authorizes only by comparing the...