CVE-2026-111604

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

EUVD-2026-103026

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

PT-2026-116003

Name of the Vulnerable Software and Affected Versions eladmin versions prior to 2.8 Description An authorization bypass exists where department-scoped user managers can modify or delete accounts outside their assigned data scope. This occurs because write handlers fail to perform necessary...

CVE-2026-111604: Authorization Bypass Through User-Controlled Key

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

eladmin authorization issue vulnerability

Eladmin versions 2.7 and earlier have an authorization issue vulnerability. This vulnerability stems from the write processing program skipping department checks, allowing unauthorized access. Attackers with the user:edit or user:del permissions can send PUT or DELETE requests to /api/users,...

CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

PT-2024-37081

Name of the Vulnerable Software and Affected Versions: snipe-it versions 4.6.17 through 6.4.1 Description: The issue allows users with User:edit and Self:api permissions to promote or demote themselves or other users by performing changes to the group's memberships via an API call. Recommendation...