CVE-2026-111604

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

EUVD-2026-103026

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604

The eladmin framework, versions through 2.7 , is vulnerable to an authorization bypass (CWE-639) within the /api/users endpoints. The root cause is that write handlers skip mandatory department checks , allowing department-scoped user managers to exceed their intended data scope. An attacker poss...

CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

EUVD-2026-102904

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-106705: Improper Access Control

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-106705

The ELADMIN (eladmin-mp) framework, up to version 2.7 , is susceptible to an improper access control vulnerability within the role management module. Specifically, the PUT /api/roles/menu (RoleController.updateRoleMenu) endpoint fails to validate the granted menu set and does not prevent a caller...

PT-2026-116003

Name of the Vulnerable Software and Affected Versions eladmin versions prior to 2.8 Description An authorization bypass exists where department-scoped user managers can modify or delete accounts outside their assigned data scope. This occurs because write handlers fail to perform necessary...

CVE-2026-111604: Authorization Bypass Through User-Controlled Key

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-106700

ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs n...

CVE-2026-106701

ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...

EUVD-2026-102256

ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...

CVE-2026-106700

ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs n...

CVE-2026-106701

ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...

CVE-2026-106701: Undefined Security Weakness

ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...

PT-2026-115095

Name of the Vulnerable Software and Affected Versions ELADMIN versions prior to 2.7 Description Cross Site Scripting XSS occurs via the WebSocketServer component, SpringSecurityConfig, and deploy.vue. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other...