CVE-2026-108706

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...

CVE-2026-108706 eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...

CVE-2026-108706 eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...

CVE-2026-108706

The eladmin framework (up to commit 55fbf70 ) is vulnerable to a missing authorization flaw in the downloadS3Storage handler. This allows any authenticated user to retrieve stored object URLs without the necessary storage permissions by enumerating sequential IDs against the GET /api/s3Storage/do...

CVE-2026-108706 eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...

EUVD-2026-96702

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...

CVE-2026-108706: Missing Authorization

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...

PT-2026-109997

Name of the Vulnerable Software and Affected Versions eladmin versions prior to commit 55fbf70 Description A missing authorization issue exists in the downloadS3Storage handler. This allows any authenticated user to retrieve stored object URLs even if they lack the necessary storage permissions. ...