CVE-2026-108706

The eladmin framework (up to commit 55fbf70 ) is vulnerable to a missing authorization flaw in the downloadS3Storage handler. This allows any authenticated user to retrieve stored object URLs without the necessary storage permissions by enumerating sequential IDs against the GET /api/s3Storage/do...