CVE-2026-111604 — eladmin through 2.7 Broken Access Control via /api/users Update and Delete
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because writ…
Published: 2026-10-16 · CVSS: 5.1 · CVSS 4.0
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7